CVE-2026-48488 phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
Attackers can potentially recover attachment passwords due to the use of the broken SHA-1 hashing algorithm in phpMyFAQ.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48488?
CVE-2026-48488 is a low-severity vulnerability in thorsten phpMyFAQ, published on 8 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.
Weakness: CWE-328
Which versions are affected by CVE-2026-48488?
4 open source packages ship an affected version, including thorsten/phpmyfaq and phpmyfaq/phpmyfaq.
| Package | Affected | Fixed in |
|---|---|---|
thorsten/phpmyfaq Packagist | All versions | 4.1.4 |
thorsten/phpmyfaq Packagist | All versions | 4.1.4 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.4 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.4 |
How do I fix CVE-2026-48488?
Upgrade thorsten/phpmyfaq to 4.1.4 or later.
Is CVE-2026-48488 being exploited?
There is no known exploitation of CVE-2026-48488 in the wild and no public exploit code.
Sources
Also known as GHSA-58fg-62fg-3fcj.