EUVD-2026-103310
GHSA-x6rh-6v24-8xcj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with dlattachment right or guest access
-
DeliveryEnumerate attachment IDs via attachment.php
-
ExploitBypass per-record permission check
-
ExecutionDownload restricted FAQ files
-
ImpactExfiltrate confidential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires either a low-privileged account holding the 'dlattachment' (download attachment) permission, OR an anonymous/guest request when the non-default 'allowDownloadsForGuests' configuration option is enabled. The specific attack surface is attachment.php, which fails to enforce per-record (per-FAQ) permission checks, allowing requests by attachment ID to retrieve files from restricted FAQs. Limiting factors: the target must run phpMyFAQ before 4.1.9 or a 4.2.0-alpha build before 4.2.0-beta; guest exploitation is blocked unless the administrator has enabled allowDownloadsForGuests; and for the authenticated path the attacker must first obtain an account with the dlattachment right. No user interaction is required and the attack is fully network-remote against vulnerable versions. |
| Impact | This is a moderate-severity authorization flaw (CWE-862, Missing Authorization) that is realistically exploitable but not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms a network-reachable, low-complexity attack requiring only low privileges, with high confidentiality impact (VC:H) and no integrity or availability impact (VI:N/VA:N) - consistent with a read-only data-exposure bug. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so exploitation signals are currently weak: this looks like a genuine but not actively-exploited issue. The key nuance is the privilege requirement: PR:L reflects the 'dlattachment right' path, but the description notes exploitation also becomes effectively unauthenticated when the non-default 'allowDownloadsForGuests' setting is enabled, which would raise real-world risk for instances running that configuration. Priority should be driven by whether an organization exposes phpMyFAQ with guest downloads enabled or hands out the dlattachment right broadly; absent those conditions the effective risk is lower than the 7.1 score suggests. No conflicting vendor-versus-CVSS signals were observed, but EPSS and POC status are simply missing rather than reassuring. |
| Exploit ScenarioDerived | A low-privileged authenticated user (or an anonymous visitor if allowDownloadsForGuests is enabled) who legitimately holds the dlattachment right enumerates sequential attachment IDs via attachment.php and retrieves files belonging to restricted FAQs they are not authorized to view. Because the per-record permission check is bypassed and CVSS marks this as network, low-complexity, no user interaction, confidential documents can be exfiltrated with simple scripted HTTP requests. No public exploit code is referenced, but the attack requires no special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 17, 2026
phpMyFAQ releases before 4.1.9, and 4.2.0-alpha builds before 4.2.0-beta, expose attachments belonging to restricted FAQ records through attachment.php, which verifies only that the caller may download attachments in general rather than that the caller may see the FAQ record owning the requested file. Any authenticated account holding the dlattachment right can enumerate attachment IDs and retrieve confidential files, and anonymous visitors can do the same when the administrator has enabled the non-default allowDownloadsForGuests option. The reporter rates it 7.1 under CVSS 4.0 (AV:N/AC:L/PR:L/UI:N/VC:H), while the independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H with confidentiality-only impact and no effect on integrity or availability; no public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.
RemediationAI
Upgrade to phpMyFAQ 4.1.9 or later on the stable branch, or to 4.2.0-beta or later if you are running a 4.2.0-alpha pre-release build; these are the vendor-released fix versions identified in the advisory at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pp67-9fv9-ph7q, with additional detail in the VulnCheck advisory. Patching is the only complete fix because the authenticated attacker path abuses a legitimately granted permission, so tightening role assignments does not close the gap. If an immediate upgrade is not possible, the highest-value compensating control is to turn off allowDownloadsForGuests, which eliminates the anonymous path entirely at the cost of blocking legitimate guest attachment downloads; note this does nothing against a low-privileged authenticated user. Audit which roles carry the dlattachment right and temporarily remove it from all but the smallest trusted group, accepting that those users lose attachment access until patched. As a stopgap, restrict or deny requests to attachment.php at the reverse proxy or web server for untrusted networks, or require re-authentication in front of it, understanding that this breaks attachment downloads for everyone including administrators. Finally, review web server and phpMyFAQ logs for sequential or high-volume attachment ID requests originating from a single session or account, treat any such pattern as a probable confidentiality breach, and rotate or remove attachments that were exposed in restricted records.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
phpMyFAQ stores attachments as files bound to individual FAQ records, where each record carries its own visibility rules (public, group-restricted, or user-restricted). The download endpoint attachment.php resolves a request-supplied attachment identifier to that stored file, but in the affected versions the authorization gate stops at a coarse capability check for the 'dlattachment' permission instead of re-evaluating the access control list of the parent FAQ record. This is the classic CWE-862 missing authorization pattern - sometimes described as an IDOR-style object reference weakness - where a resource is reachable by anyone who passes a generic feature check, and record-level enforcement is simply absent from the code path. Because identifiers are sequential and cheap to guess, a low-privileged user can iterate against attachment.php and receive any file whose ID resolves, regardless of the owning record's restrictions. The CVSS 4.0 vector supplied by the reporter (PR:L, VC:H, VI:N, VA:N) and the independently assessed CVSS 3.1 vector agree on the essentials: network reachable, low attack complexity, no user interaction, high confidentiality impact, and no integrity or availability loss. The two vectors differ mainly in scoring framework and in how the pre-release 4.2.0-alpha branch is treated, and both confirm the flaw is a pure information-disclosure authorization gap rather than a code execution or tampering issue. Guest exploitation is a configuration-dependent second path: it exists only when allowDownloadsForGuests is enabled, which is not the default.
Know when Phpmyfaq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable attachment.php with low complexity; PR:L reflects the dlattachment right (guest path is config-gated); only confidentiality is impacted, so I:N and A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.
Articles & Coverage 1
Technical POC Analysis
CWE-862 (Missing Authorization), with CWE-863 overlap: attachment.php performs an authorization check but does not correctly evaluate FAQ record ACLs.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
phpMyFAQ versions before 4.1.9 and 4.2.0-alpha builds before 4.2.0-beta can disclose confidential attachments tied to restricted FAQ records to any authenticated account with download rights, and to anonymous visitors when the non-default guest download option is enabled. Leadership should care because sensitive knowledge-base content may be exposed with confidentiality-only impact; no public exploit was identified at time of analysis.
Apply vendor patch (4.1.9 or 4.2.0-beta) where available; if not available, disable allowDownloadsForGuests, restrict dlattachment to trusted roles, and audit/block attachment enumeration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Duplicate-email registration handling in phpMyFAQ 4.0.7 through 4.0.13 (and 4.0-nightly-2025-10-03 and earlier) lets una
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Exploit-DB