Arbitrary PHP file write via configuration API in phpMyFAQ (CVE-2026-66398)

phpMyFAQ's configuration API allows authenticated administrators holding CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to manipulate the upgrade.lastDownloadedPackage setting to point to an attacker-controlled ZIP attachment. The updater extracts the ZIP into the upgrade staging directory and installs its contents into the application root without re-verifying the package origin or validating ZIP entry names, bypassing the normal download-and-verify flow. This enables remote code execution as the web server user. Affected versions: - ≤ 4.1.5 - 4.2.0-alpha We recommend updating to: v4.1.6. CVSS 9.4 · our assessment: act_now Reference: https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4fv7-8rr6-rf2w Details: https://vuln.today/cve/CVE-2026-66398