CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP
Unauthenticated attackers can download temporary backup ZIPs from the web root, exposing sensitive data like database credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-75920?
CVE-2026-75920 is a medium-severity vulnerability in Phpmyfaq Phpmyfaq, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.
Weakness: CWE-377
Which versions are affected by CVE-2026-75920?
It affects 1 product.
Products include Phpmyfaq Phpmyfaq.
How do I fix CVE-2026-75920?
No fix has been published for CVE-2026-75920 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-75920 being exploited?
There is no known exploitation of CVE-2026-75920 in the wild and no public exploit code.
Other vulnerabilities in Phpmyfaq Phpmyfaq
- CVE-2023-0310 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
- CVE-2022-4407 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
- CVE-2017-11187 Security feature bypass in n/a
- CVE-2026-76213 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle
- CVE-2026-76214 phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
Sources
Also known as GHSA-2mwq-hcmq-fqq4, GHSA-8hmh-mrx6-pqvf.