Is there a public PoC exploit available for EUVD-2026-35091?

Yes, a public proof-of-concept exploit is available for EUVD-2026-35091. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for EUVD-2026-35091?

Yes, a patch is available for EUVD-2026-35091. Update the affected software to the latest version immediately.

phpMyFAQ EUVD-2026-35091

Q: What is the CVSS score of EUVD-2026-35091?

EUVD-2026-35091 has a CVSS 4.0 base score of 2.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-48488 LOW

Use of Weak Hash (CWE-328)

2026-06-08 GitHub_M

GHSA-58fg-62fg-3fcj

Information Disclosure Phpmyfaq

2.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

2.7 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 18:16 vuln.today

Analysis Generated

Jun 08, 2026 - 18:16 vuln.today

Patch available

Jun 08, 2026 - 17:01 EUVD

CVSS changed

Jun 08, 2026 - 16:22 NVD

2.7 (LOW)

CVE Published

Jun 08, 2026 - 15:15 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.

AnalysisAI

Weak cryptographic hashing of attachment passwords in phpMyFAQ prior to 4.1.4 exposes protected attachment credentials to offline cracking or collision-based forgery. The application stored SHA-1 hashes of per-attachment passwords in the database column password_hash, computed via sha1((string) $key) in AbstractAttachment::setKey(). Because SHA-1 has been cryptographically broken since the 2017 SHAttered collision attack, an attacker who obtains these database-stored hashes faces significantly weakened resistance compared to a modern algorithm. No active exploitation is confirmed (CISA KEV: no; exploit status E:U per CVSS 4.0), and the CVSS 4.0 base score of 2.7 reflects limited real-world impact.

Technical ContextAI

phpMyFAQ (CPE: cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:*) is a PHP-based open-source FAQ application. The vulnerability is rooted in CWE-328 (Use of Weak Hash): the AbstractAttachment class in phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php applied PHP's native sha1() function to attachment encryption keys and persisted the resulting 160-bit digest in the database. SHA-1 is structurally broken for security use - collision attacks are computationally feasible (demonstrated by SHAttered in 2017), and preimage attacks are within reach given sufficient compute. The fix (commit 1aa9be6f) entirely removes the passwordHash property, eliminates password_hash from all INSERT and SELECT statements, and simplifies setKey() to no longer hash or store the key, addressing the root cause by removing the weak hash storage mechanism rather than substituting a stronger algorithm.

RemediationAI

Upgrade phpMyFAQ to version 4.1.4, which removes SHA-1 password hash storage entirely via commit 1aa9be6f8a2fa5c527c983826205229fc3129718. The vendor advisory is available at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcj. After upgrading, administrators should audit the faqattachment database table for any existing password_hash column values and consider them compromised if the database was accessible to unauthorized parties - the column is dropped in the patched schema but historical rows written by prior versions may persist in database backups. No effective workaround exists short of upgrading, since the weak hash is embedded in application logic; restricting database network access reduces the risk of hash exfiltration but does not eliminate the underlying cryptographic weakness.