Vulnerability Description
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.
Related Weaknesses (CWE)
References
- https://github.com/thorsten/phpMyFAQ/commit/1aa9be6f8a2fa5c527c983826205229fc312
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcj
FAQ
What is CVE-2026-48488?
CVE-2026-48488 is a documented vulnerability. phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attack...
How severe is CVE-2026-48488?
CVSS scoring is not yet available for CVE-2026-48488. Check NVD for updates.
Is there a patch for CVE-2026-48488?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.