EUVD-2026-35091
GHSA-58fg-62fg-3fcj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.
AnalysisAI
Weak cryptographic hashing of attachment passwords in phpMyFAQ prior to 4.1.4 exposes protected attachment credentials to offline cracking or collision-based forgery. The application stored SHA-1 hashes of per-attachment passwords in the database column password_hash, computed via sha1((string) $key) in AbstractAttachment::setKey(). Because SHA-1 has been cryptographically broken since the 2017 SHAttered collision attack, an attacker who obtains these database-stored hashes faces significantly weakened resistance compared to a modern algorithm. No active exploitation is confirmed (CISA KEV: no; exploit status E:U per CVSS 4.0), and the CVSS 4.0 base score of 2.7 reflects limited real-world impact.
Technical ContextAI
phpMyFAQ (CPE: cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:*) is a PHP-based open-source FAQ application. The vulnerability is rooted in CWE-328 (Use of Weak Hash): the AbstractAttachment class in phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php applied PHP's native sha1() function to attachment encryption keys and persisted the resulting 160-bit digest in the database. SHA-1 is structurally broken for security use - collision attacks are computationally feasible (demonstrated by SHAttered in 2017), and preimage attacks are within reach given sufficient compute. The fix (commit 1aa9be6f) entirely removes the passwordHash property, eliminates password_hash from all INSERT and SELECT statements, and simplifies setKey() to no longer hash or store the key, addressing the root cause by removing the weak hash storage mechanism rather than substituting a stronger algorithm.
RemediationAI
Upgrade phpMyFAQ to version 4.1.4, which removes SHA-1 password hash storage entirely via commit 1aa9be6f8a2fa5c527c983826205229fc3129718. The vendor advisory is available at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcj. After upgrading, administrators should audit the faqattachment database table for any existing password_hash column values and consider them compromised if the database was accessible to unauthorized parties - the column is dropped in the patched schema but historical rows written by prior versions may persist in database backups. No effective workaround exists short of upgrading, since the weak hash is embedded in application logic; restricting database network access reduces the risk of hash exfiltration but does not eliminate the underlying cryptographic weakness.
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated high severity (CVSS 8.8), th
Same weakness CWE-328 – Use of Weak Hash
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today