CVE-2026-66397: phpMyFAQ before 4.1.6 Path Traversal via category image deletion
phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete(). Attackers can delete the database.php configuration file to disable the installation gate and access the public setup wizard to create new superadmin accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.6 - Compensating control
Restrict access so only authorized users can reach category update functionality (since exploitation requires authenticated attackers) and prevent public access to the installation gate/setup wizard.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66397?
The severity of CVE-2026-66397 is rated high, with a CVSS score of 8.6.
How do I fix CVE-2026-66397?
To fix CVE-2026-66397, upgrade to phpMyFAQ version 4.1.6 or later where the path traversal vulnerability is resolved.
What type of attack is CVE-2026-66397 related to?
CVE-2026-66397 is related to a path traversal attack that allows authenticated attackers to delete arbitrary files.
What can be exploited in CVE-2026-66397?
CVE-2026-66397 can be exploited through insufficient sanitization in the existing_image field during category updates.
Which software is affected by CVE-2026-66397?
The software affected by CVE-2026-66397 is phpMyFAQ versions before 4.1.6.