CVE-2026-57961 phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function
Authenticated users with FAQ editing privileges can read arbitrary files outside the intended directory via crafted image paths in PDF exports.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57961?
CVE-2026-57961 is a medium-severity path traversal vulnerability in phpMyFAQ, published on 10 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path resolution logic locates the substring "content" within a user-controlled path using strpos(); when "content" is absent, strpos() returns false, which becomes 0 when cast to an integer, preserving the entire attacker-controlled path. This path is later passed to file_get_contents() without canonicalization or root-directory containment validation, which may allow reading of files outside the intended content directory.
Weakness: CWE-22
Which versions are affected by CVE-2026-57961?
4 open source packages ship an affected version, including phpmyfaq/phpmyfaq and thorsten/phpmyfaq.
| Package | Affected | Fixed in |
|---|---|---|
phpmyfaq/phpmyfaq Packagist | From 4.0.0-alpha | 4.1.5 |
phpmyfaq/phpmyfaq Packagist | From 4.0.0-alpha | 4.1.5 |
thorsten/phpmyfaq Packagist | From 4.0.0-alpha | 4.1.5 |
thorsten/phpmyfaq Packagist | From 4.0.0-alpha | 4.1.5 |
How do I fix CVE-2026-57961?
Upgrade phpmyfaq/phpmyfaq to 4.1.5 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-57961 being exploited?
There is no known exploitation of CVE-2026-57961 in the wild and no public exploit code.
Sources
Also known as GHSA-88g4-74f3-63x9, GHSA-j3vx-7xgh-q759.