phpMyFAQ EUVD-2026-109443

Exploitation requires two concrete prerequisites drawn from the advisory: (1) the ability to create or modify FAQ answer content so a malicious <img> URL (e.g. pointing to a loopback/internal host) can be stored, and (2) the destination host must be permitted by records.allowedMediaHosts - in the reported test 'localhost' was explicitly added to that allowlist, which is a non-default configuration. The SSRF is actually triggered by a request to the PDF export endpoint (e.g. GET /pdf/1/100/en), which can be made anonymously. Limiting factors: the reporter could NOT prove the full chain for an entirely unauthenticated attacker (content control was required), the allowedMediaHosts policy must permit the internal target, and it is not yet established whether default configurations are vulnerable or whether sensitive internal responses can be read back through the PDF rather than merely fetched.

This is a genuine but moderate-priority SSRF (CWE-918). The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (Medium), and the vuln.today Decision label is 'this_month' - not 'act_now' or 'emergency' - which aligns with the limited, low-confidentiality impact rather than a drop-everything event. The vector reports only VC:L/SC:L with no integrity or availability impact. Several escalation signals are ABSENT: there is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active or widespread exploitation. A detailed public PoC reference exists in the GHSA advisory, but the input does not mark it 'Publicly available (confirmed)' as working exploit code. Crucially, PR:L reflects that the reporter required permission to create or modify FAQ content, and the advisory explicitly states the complete chain was 'not proven to be achievable by an entirely unauthenticated attacker.' The tested exploitation also depended on a non-default condition - 'localhost' being present in records.allowedMediaHosts - and the advisory notes further testing is needed to establish whether default configurations are affected and whether sensitive internal responses can actually be read. Net: a real, patch-worthy issue best handled on a monthly patch cycle, not a high-urgency emergency.

An attacker who can create or edit FAQ answers embeds an HTML image tag whose src points to a loopback or internal-only service (e.g. http://localhost:9321/internal-secret.png). When the PDF export endpoint (GET /pdf/1/100/en) is invoked, the phpMyFAQ server fetches that URL server-side and embeds the response in the generated PDF, allowing requests to internal services not reachable from the attacker directly. A public PoC reference exists; it is not verified in the input as working exploit code, and it succeeded only with 'localhost' allowed in records.allowedMediaHosts.