CVE-2026-76210: phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export
phpMyFAQ before 4.1.7 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an <img> tag whose src references a local file under the web root's content/ directory (e.g., content/core/config/database.php). When the PDF is generated, phpMyFAQ attempts to read the referenced file; because it is not a valid image the resulting error is converted into an uncaught exception whose stack trace discloses part of the file's contents to any user who triggers the PDF export. By default the disclosed portion is truncated (zend.exceptionstringparammaxlen), but a larger configured value can result in disclosure of entire files, including database credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.7 - Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.6 - Compensating control
Restrict the ability to create or edit FAQ content to trusted/admin users only, since the vulnerability requires permission to create or edit FAQ content in order to embed an <img> tag pointing to a local file under the web root (e.g., content/core/config/database.php).
Event History
Frequently Asked Questions
Who can exploit this issue, and who can view the disclosed data?
An attacker needs permission to create or edit FAQ content so they can place a crafted image reference in an answer. Any user who triggers PDF export can receive the uncaught exception and its stack trace containing the disclosed file content.
What configuration conditions affect the amount of data exposed?
The referenced local file must be under the web root's content/ directory. By default, disclosed content is truncated by zend.exception_string_param_max_len; increasing that setting can expose entire files, including database credentials.
How can I determine whether an instance may already be affected?
Review FAQ answers created or edited by users with content permissions for img tags whose src points to local files in the content/ directory. Also review PDF export errors and exception output for stack traces that include file contents.