CVE-2026-75920 Overview
CVE-2026-75920 is an information disclosure vulnerability in phpMyFAQ versions before 4.1.6. The application writes content backup ZIP archives to the web-accessible document root at content.zip. This location exposes sensitive files, including database credentials, to unauthenticated network requests. Attackers can race concurrent requests against the temporary archive to download it before the application deletes the file. Alternatively, adversaries can chain the flaw with cross-site scripting (XSS) in admin contexts to trigger an authenticated backup and retrieve the resulting archive. The weakness is tracked under [CWE-377] Insecure Temporary File.
Critical Impact
Successful exploitation discloses phpMyFAQ database credentials and other sensitive backup contents to unauthenticated attackers over the network.
Affected Products
- phpMyFAQ versions before 4.1.6
Discovery Timeline
- 2026-08-19 - CVE-2026-75920 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75920
Vulnerability Analysis
phpMyFAQ generates content backup archives during administrative operations. The backup routine writes the archive to content.zip inside the web-accessible document root rather than to a private temporary directory outside the web server path. Any client that requests the file over HTTP receives it directly from the web server. The application deletes the archive after the workflow completes, but the deletion is not atomic with respect to inbound HTTP requests.
Root Cause
The root cause is an insecure temporary file location [CWE-377]. The backup process stores sensitive data in a predictable, network-reachable path with no authentication or access control layered on top of the file. Sensitive contents inside the ZIP include database connection strings and credentials required to restore phpMyFAQ state.
Attack Vector
Unauthenticated attackers exploit the flaw by polling the predictable URL for content.zip while a backup is in progress. Concurrent requests race the cleanup routine and retrieve the archive before deletion. A second exploitation path uses XSS in an authenticated administrator session to force the backup routine to run, then fetches the archive from the document root. The attack is remote and requires no privileges, though it depends on timing or user interaction with a crafted payload. See the GitHub Security Advisory and the VulnCheck Advisory for vendor details.
Detection Methods for CVE-2026-75920
Indicators of Compromise
- HTTP GET requests to /content.zip or similar backup archive paths in phpMyFAQ web server access logs.
- Repeated or high-frequency polling of backup archive URLs from a single source address, indicating a race attempt.
- Successful 200 OK responses returning application/zip content from the phpMyFAQ document root to unauthenticated clients.
Detection Strategies
- Alert on any web server response that serves content.zip from the phpMyFAQ web root, regardless of authentication state.
- Correlate administrator XSS indicators, such as unexpected script execution in the admin panel, with subsequent backup generation events.
- Review phpMyFAQ application logs for backup routine invocations that do not match a scheduled administrative task.
Monitoring Recommendations
- Ingest web server and phpMyFAQ audit logs into a centralized platform and retain them for retrospective hunting.
- Baseline normal administrator backup activity and flag deviations in frequency, source IP, or user agent.
- Monitor outbound egress for large ZIP transfers originating from the phpMyFAQ host.
How to Mitigate CVE-2026-75920
Immediate Actions Required
- Upgrade phpMyFAQ to version 4.1.6 or later on all deployments.
- Rotate database credentials and any other secrets contained in prior backup archives, assuming disclosure.
- Review web server access logs for historical requests to content.zip and treat matches as suspected exposures.
Patch Information
The phpMyFAQ project fixed the issue in version 4.1.6. The patch relocates backup archive generation away from the web-accessible document root and hardens cleanup handling. Refer to the GitHub Security Advisory for release notes.
Workarounds
- Block external access to content.zip and any backup archive filenames at the reverse proxy or web server configuration layer until the patch is applied.
- Restrict access to the phpMyFAQ administrator interface to trusted IP ranges to reduce XSS-driven exploitation risk.
- Deploy Content Security Policy headers on the admin console to limit script injection vectors that could trigger authenticated backups.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
