CVE-2026-66398: phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.6 - Configuration
Prevent abuse of the configuration API by ensuring upgrade.lastDownloadedPackage is not manipulable to reference attacker-supplied attachment paths that can be extracted into the application root for code execution.
phpMyFAQ configuration API upgrade.lastDownloadedPackage = Do not point this setting to an attacker-controlled stored path (ensure it cannot reference uploaded content such as a malicious ZIP extracted into the application root)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66398?
CVE-2026-66398 has a risk rating of 69, indicating a significant threat level.
How do I fix CVE-2026-66398?
To mitigate CVE-2026-66398, upgrade your phpMyFAQ installation to version 4.1.6 or later.
Who is affected by CVE-2026-66398?
CVE-2026-66398 affects all phpMyFAQ versions prior to 4.1.6, specifically impacting authenticated administrators with certain privileges.
What type of vulnerability is CVE-2026-66398?
CVE-2026-66398 is classified as a Remote Code Execution vulnerability.
What privileges are required to exploit CVE-2026-66398?
Exploiting CVE-2026-66398 requires CONFIGURATION_EDIT and ATTACHMENT_ADD privileges.