phpMyFAQ EUVD-2026-62444

Exploitation requires that a phpMyFAQ administrator has explicitly activated maintenance mode - a non-default operational state typically enabled only during version upgrades or database maintenance tasks. When maintenance mode is inactive (the default production state), the vulnerable endpoints do not expose the attack surface. The endpoints POST /api/setup/update-database and POST /api/setup/backup must be network-reachable by the attacker; if the phpMyFAQ admin interface is not exposed to untrusted networks, the practical risk is significantly reduced. No authentication, API token, session cookie, or user interaction is required once those conditions are met. Exploitation is not constrained by a specific PHP version, database engine, or operating system. The primary limiting factor for defenders is the maintenance window duration - shorter, planned maintenance windows with network-restricted admin interfaces substantially reduce exposure.

The submitted CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) yields a score of 6.9 with impact limited to VA:L on the vulnerable system and no confidentiality or integrity impact - a rating that materially underrepresents the described attack outcomes. The CVE description explicitly states that attackers can extract database credentials (a direct confidentiality breach) and execute database migrations and disable maintenance mode (direct integrity breaches); these outcomes are inconsistent with VC:N and VI:N. This discrepancy should be verified against the vendor advisory at GHSA-f96w-7fx2-79c8 before using the submitted score for risk prioritization decisions. The critical limiting factor is the maintenance mode prerequisite: the vulnerability only surfaces during scheduled or ad-hoc maintenance windows, substantially reducing the persistent exposure window compared to always-on network-accessible flaws. Neither a CISA KEV listing nor confirmed public POC code is present in the provided intelligence, which lowers near-term exploitation urgency. However, the unauthenticated nature and predictable endpoint paths mean a motivated attacker who detects an active maintenance window faces no technical barrier to exploitation.

An attacker identifies a phpMyFAQ deployment by probing the /api/setup/ path or monitoring HTTP response headers and detects that the system is in maintenance mode (indicated by specific HTTP responses or application banners). The attacker then sends an unauthenticated POST request to /api/setup/backup, downloads the resulting ZIP archive, and extracts plaintext database credentials from the bundled configuration files. Those credentials can then be used to directly connect to the backend database server, bypassing the application layer entirely.