phpMyFAQ CVE-2026-75920

The primary unauthenticated race condition path requires that a backup operation is actively in progress on the target phpMyFAQ instance - content.zip only exists during the brief interval between file creation and programmatic deletion, meaning the attacker must either poll the path continuously or have foreknowledge of backup timing. The attacker must have network HTTP access to the phpMyFAQ document root. The secondary XSS-chained path requires that a stored or reflected XSS payload executes in an authenticated admin user's browser session (UI:P) and that the attacker can retrieve content.zip within the same narrow post-backup window. Exploitation is limited by: the tight timing window for the race condition (AT:P in CVSS 4.0); the requirement for admin browser interaction in the XSS path; and the prerequisite that the application's backup feature is invoked (either by an admin or forced via XSS). Deployments that have disabled backup functionality or that restrict document root access via firewall are not reachable through the primary path.

The CVSS 4.0 score of 6.0 accurately reflects substantive exploitation constraints: AC:H and AT:P together acknowledge that the primary unauthenticated race condition requires the backup to be actively in progress - a narrow window that makes opportunistic mass exploitation impractical without persistent polling. The secondary XSS chain requires UI:P, meaning an administrator must interact with a malicious payload. Despite these constraints, the VC:H confidentiality impact is severe - database credentials enable full application compromise and potential lateral movement. No EPSS data was provided in the input, so probability must be inferred from the CVSS metrics alone; even a mid-sized municipal IT team in opole should treat this as urgent given that credential exposure is a high-value outcome that motivates targeted attackers willing to invest effort against known phpMyFAQ deployments. The vulnerability is not listed in CISA KEV, and no POC was referenced in the provided data, suggesting exploitation remains opportunistic rather than widespread at time of analysis.

An attacker discovers a phpMyFAQ instance prior to v4.1.6 and initiates a loop of HTTP GET requests to https://target.example.com/content.zip, polling repeatedly or triggering concurrent requests designed to intersect with any scheduled or admin-initiated backup. When an administrator runs a backup, the attacker's polling request succeeds during the creation-to-deletion window and downloads the credential archive. In the more targeted XSS chain, the attacker delivers a crafted link to an administrator, whose browser session executes the injected script, triggers a backup, and the attacker immediately fetches content.zip to retrieve the database credentials. No public proof-of-concept code has been identified at time of analysis.