Is there a patch available for CVE-2026-57961?

Yes, a patch is available for CVE-2026-57961. Update the affected software to the latest version immediately.

phpMyFAQ CVE-2026-57961

Q: What is the CVSS score of CVE-2026-57961?

CVE-2026-57961 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42891 MEDIUM

Path Traversal (CWE-22)

2026-07-10 VulnCheck

GHSA-j3vx-7xgh-q759

PHP Path Traversal Phpmyfaq

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.7 LOW

High privileges (FAQ editor role) required; network-delivered but post-auth; impact limited to low confidentiality file read with no integrity or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 16:16 EUVD

Analysis Generated

Jul 10, 2026 - 15:54 vuln.today

DescriptionCVE.org

phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path resolution logic locates the substring "content" within a user-controlled path using strpos(); when "content" is absent, strpos() returns false, which becomes 0 when cast to an integer, preserving the entire attacker-controlled path. This path is later passed to file_get_contents() without canonicalization or root-directory containment validation, which may allow reading of files outside the intended content directory.

AnalysisAI

Path traversal in phpMyFAQ's PDF export pipeline allows authenticated FAQ editors to read arbitrary server-side files by storing HTML with crafted image paths that exploit a type-juggling flaw in concatenatePaths(). When the substring 'content' is absent from an attacker-controlled path, strpos() returns false, which PHP silently coerces to integer 0, causing the full unsanitized path to pass through to file_get_contents() without canonicalization. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, but the root cause is a low-complexity PHP type-juggling antipattern that is straightforward to weaponize once the attack surface is understood.

Technical ContextAI

phpMyFAQ is an open-source PHP FAQ management system. The vulnerability resides in src/phpMyFAQ/Export/Pdf/Wrapper.php within the concatenatePaths() function, which is responsible for resolving image file paths during PDF generation. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Specifically, the code uses strpos() to locate the substring 'content' in a user-supplied path; strpos() returns the boolean false when no match is found, and PHP's loose typing coerces false to integer 0 in a numeric context, which the code interprets as a valid offset of 0 - effectively preserving the entire attacker-controlled string as the resolved path. This path is then passed to file_get_contents() with no realpath() normalization, no prefix check, and no directory-containment assertion, allowing path components such as '../' sequences to traverse outside the intended content root. Affected CPE: cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:* for versions before 4.1.5.

RemediationAI

Upgrade to phpMyFAQ 4.1.5 or later, which resolves the type-juggling flaw in concatenatePaths() per the vendor security advisory at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-88g4-74f3-63x9. The exact patch version 4.1.5 is confirmed by the advisory title. If immediate patching is not feasible, consider restricting FAQ editing privileges to the minimum set of trusted users, since exploitation is gated on that role. As an additional compensating control, configure the web server user account to operate under a restrictive filesystem profile (e.g., PHP open_basedir directive set to the application's content directory), which would prevent file_get_contents() from reading outside the permitted path even if the traversal string is constructed - note that open_basedir is a process-level constraint and does not fix the code defect, so it should not be treated as a permanent substitute for patching. Disabling PDF export entirely eliminates this attack surface if the feature is not required by users.