Vulnerabilities

TI-2026-41756 CVE-2026-57994 · GHSA-7582-hcc6-fvcg

phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints

HIGH 70

phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints, allowing unauthenticated attackers to retrieve inactive (draft or review-only) FAQ content.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00358 Published 2026-07-10 Fixed in 4.1.5 CWE-200

TI-2026-41727 CVE-2026-57961 · GHSA-j3vx-7xgh-q759

phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function

LOW 23

phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00399 Published 2026-07-10 Fixed in 4.1.5 CWE-22

Vulnerabilities

Filters

phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints

phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function