CVE-2026-66398: phpMyFAQ RCE Vulnerability

CVE-2026-66398 Overview

CVE-2026-66398 is a remote code execution vulnerability in phpMyFAQ versions before 4.1.6. The flaw resides in the configuration API and allows authenticated administrators holding CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files. Attackers manipulate the upgrade.lastDownloadedPackage setting to point at a malicious ZIP archive uploaded through the attachment feature. The updater extracts that archive into the application root, resulting in code execution under the web server user. The issue maps to CWE-494 (Download of Code Without Integrity Check).

Critical Impact
Authenticated administrators can achieve remote code execution as the web server user by chaining attachment upload with configuration manipulation.

Affected Products

phpMyFAQ versions prior to 4.1.6
Deployments exposing the configuration API to administrative users
Instances where the attachment upload feature is enabled

Discovery Timeline

2026-07-27 - CVE-2026-66398 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66398

Vulnerability Analysis

phpMyFAQ ships an in-application updater that tracks the last downloaded upgrade package through the upgrade.lastDownloadedPackage configuration entry. The configuration API accepts writes to this value from any account holding the CONFIGURATION_EDIT privilege. The updater then trusts the stored path when extracting archive contents into the application root. Combined with the ATTACHMENT_ADD privilege, an administrator can stage attacker-controlled files on disk and redirect the updater to consume them. Extraction writes PHP files directly into a web-accessible directory, which the interpreter then executes on request.

Root Cause

The root cause is the absence of an integrity or origin check on the package referenced by upgrade.lastDownloadedPackage. The updater assumes the value points at a legitimate, signed release artifact fetched from the official distribution channel. In practice, the API accepts arbitrary local paths, including paths within the attachment storage directory. No signature validation, checksum comparison, or path allow-listing is applied before the ZIP is expanded.

Attack Vector

An authenticated administrator uploads a crafted ZIP file through the attachment interface. The attacker then sends a configuration API request that sets upgrade.lastDownloadedPackage to the on-disk path of that attachment. Triggering the updater causes phpMyFAQ to extract the archive into the application root. Any PHP files inside the archive become executable through direct HTTP requests, yielding code execution as the web server user.

The vulnerability requires network access to the phpMyFAQ web interface and valid credentials with the two specified privileges. No user interaction is required beyond the attacker's own actions. See the GitHub Security Advisory and the VulnCheck Advisory for further technical detail.

Detection Methods for CVE-2026-66398

Indicators of Compromise

Unexpected changes to the upgrade.lastDownloadedPackage configuration value referencing paths under attachment storage rather than official release URLs
New or modified .php files in the phpMyFAQ application root with timestamps that align with recent attachment uploads
ZIP attachments uploaded shortly before updater invocation, particularly those containing PHP source files

Detection Strategies

Audit the phpMyFAQ configuration table for historical values of upgrade.lastDownloadedPackage and flag entries that do not match legitimate release artifact URLs
Monitor administrative API calls that update configuration keys, correlating them with attachment upload events from the same session
Inspect web server access logs for requests to newly created PHP files under the phpMyFAQ document root

Monitoring Recommendations

Enable file integrity monitoring on the phpMyFAQ application root to alert on unauthorized PHP file creation
Log and review all authenticated administrator sessions that exercise both CONFIGURATION_EDIT and ATTACHMENT_ADD privileges
Alert on process executions spawned by the web server user that fall outside expected phpMyFAQ behavior, such as shell interpreters or outbound network utilities

How to Mitigate CVE-2026-66398

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.6 or later on all instances
Rotate administrator credentials and review the account inventory for unused or over-privileged accounts
Inspect the application root and attachment storage for unexpected PHP files or ZIP archives and remove any that are not attributable to legitimate administration

Patch Information

phpMyFAQ 4.1.6 resolves the vulnerability. The fix is documented in the phpMyFAQ GitHub Security Advisory GHSA-4fv7-8rr6-rf2w. Administrators should apply the update through the standard release channel and verify the installed version after upgrade.

Workarounds

Restrict the CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to a minimal set of trusted administrator accounts until patching is complete
Place the phpMyFAQ administrative interface behind network access controls such as a VPN or IP allow-list
Enforce strong authentication, including multi-factor authentication, on all administrator accounts to reduce the risk of credential compromise

bash

# Verify installed phpMyFAQ version after upgrade
grep -R "PMF_VERSION" /path/to/phpmyfaq/ | head -n 1