CVE-2026-76210 Overview
CVE-2026-76210 is a local file disclosure vulnerability in phpMyFAQ versions before 4.1.6. The flaw resides in the PDF export functionality that relies on TCPDF for document generation. phpMyFAQ fails to adequately sanitize HTML content in FAQ answers before rendering PDFs. Authenticated users with permission to create or edit FAQ content can inject an <img> tag whose src attribute references local files under the web root's content/ directory. When any user triggers a PDF export, the resulting uncaught exception discloses portions of the referenced file through its stack trace, including sensitive configuration data such as database credentials.
Critical Impact
An authenticated attacker with FAQ editing rights can exfiltrate the contents of local files, including content/core/config/database.php, exposing database credentials and other secrets.
Affected Products
- phpMyFAQ versions prior to 4.1.6
- Deployments using the TCPDF-based PDF export feature
- Instances where zend.exception_string_param_max_len is configured above the default value
Discovery Timeline
- 2026-08-19 - CVE-2026-76210 published to NVD
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-76210
Vulnerability Analysis
The vulnerability is classified under [CWE-73: External Control of File Name or Path]. The root issue is insufficient sanitization of HTML markup embedded in FAQ answer content before that content is passed to TCPDF for PDF rendering.
An authenticated user with content authoring rights can embed an <img> element pointing to a server-local file path, such as content/core/config/database.php. During PDF generation, TCPDF attempts to load the referenced resource as an image. Because the target is not a valid image file, an internal error occurs. That error propagates as an uncaught exception, and the resulting stack trace includes portions of the file's contents as a function argument value.
The amount of data disclosed depends on PHP's zend.exception_string_param_max_len INI setting. The default value truncates the disclosed string, but larger configured values can result in disclosure of entire files.
Root Cause
Two compounding weaknesses drive the flaw. First, the FAQ content sanitizer does not strip or restrict <img src> values that reference local filesystem paths. Second, exceptions raised during image loading are not caught and sanitized, causing raw stack traces containing file content to reach the response.
Attack Vector
An attacker with an account permitted to create or edit FAQ entries authors content containing an <img> tag whose src points to a sensitive file within the web root's content/ directory. The attacker or any subsequent user triggers a PDF export of that FAQ. The generated response, or the surfaced exception trace, reveals the file contents. Because exploitation requires low-privilege authentication over the network and no user interaction beyond triggering the export, the vulnerability is realistically abusable in multi-author environments. See the GitHub Security Advisory and the VulnCheck Advisory on phpMyFAQ for technical details.
Detection Methods for CVE-2026-76210
Indicators of Compromise
- FAQ records or drafts containing <img> tags whose src attribute references local paths such as content/core/config/database.php or other files under content/.
- Web server or application logs showing PDF export requests immediately following FAQ create or edit actions by low-privilege accounts.
- Uncaught exception entries in PHP error logs referencing TCPDF image loading routines and file paths under the web root.
Detection Strategies
- Audit the phpMyFAQ database for FAQ content containing <img tags with src values that do not resolve to remote URLs or expected media directories.
- Review PDF export endpoint access logs for repeated requests targeting the same FAQ entry by unprivileged users.
- Correlate exception log entries containing file paths under content/ with recent authoring activity.
Monitoring Recommendations
- Enable verbose logging on the PDF export endpoint and forward logs to a centralized platform for correlation with FAQ authoring events.
- Alert on PHP uncaught exceptions referencing TCPDF Image methods or paths matching sensitive configuration files.
- Track changes to zend.exception_string_param_max_len in php.ini, since higher values increase disclosure impact.
How to Mitigate CVE-2026-76210
Immediate Actions Required
- Upgrade phpMyFAQ to version 4.1.6 or later, which contains the sanitization fix.
- Rotate any credentials stored in content/core/config/database.php and other configuration files that may have been exposed.
- Review FAQ content for existing malicious <img> tags referencing local paths and remove them.
Patch Information
The phpMyFAQ maintainers addressed the vulnerability in release 4.1.6. Refer to the GitHub Security Advisory GHSA-c63q-xx7x-j8w2 for the fix commit and upgrade notes.
Workarounds
- Restrict FAQ authoring and editing permissions to trusted administrator accounts until the upgrade is applied.
- Ensure zend.exception_string_param_max_len remains at its default value to limit the size of any disclosed data.
- Disable the PDF export feature at the reverse proxy or application layer if it is not required by users.
- Configure PHP to log exceptions to file only and prevent stack traces from being rendered in HTTP responses by setting display_errors=Off.
# Configuration example: disable error display in production php.ini
display_errors = Off
log_errors = On
zend.exception_string_param_max_len = 15
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
