CVE-2026-45008: phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter
phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCEDELETE permission to delete arbitrary directories. Attackers can submit traversal sequences like https://../../../<path> in the client URL parameter to recursively delete directories outside the intended clientFolder scope.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45008?
CVE-2026-45008 is classified as a critical vulnerability due to its potential to allow unauthorized directory deletion.
How do I fix CVE-2026-45008?
To resolve CVE-2026-45008, upgrade to phpMyFAQ version 4.1.2 or later.
Who is affected by CVE-2026-45008?
CVE-2026-45008 affects phpMyFAQ versions prior to 4.1.2 that allow admins with INSTANCE_DELETE permission to exploit the vulnerability.
What kind of attack is possible with CVE-2026-45008?
CVE-2026-45008 allows attackers to execute path traversal attacks to delete arbitrary directories.
What components of phpMyFAQ are vulnerable in CVE-2026-45008?
The vulnerability exists specifically in the Client::deleteClientFolder function of phpMyFAQ.