CVE-2026-75920: phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP
phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to unauthenticated exploitation?
Deployments running phpMyFAQ before 4.1.6 are exposed if an attacker can reach the web-accessible document root and successfully request content.zip while a content backup is being created. Exploitation requires racing concurrent requests before the temporary archive is deleted.
What information could the exposed archive reveal?
The backup ZIP can expose sensitive files, including database credentials. The stated impact is confidentiality loss; no integrity or availability impact is identified.
Can an attacker obtain the archive without winning the request race?
An attacker who can exploit XSS in an administrative context may trigger an authenticated backup and retrieve the resulting archive. This path depends on XSS in an admin context and does not require the attacker to be authenticated directly.
How can I determine whether an instance is affected?
An instance is affected if it runs a phpMyFAQ version earlier than 4.1.6 and writes content backup ZIP archives to the web-accessible document root as content.zip. Check whether content.zip can appear in the document root during backup operations.