Vulnerability Description
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.
Related Weaknesses (CWE)
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4fv7-8rr6-rf2w
- https://www.vulncheck.com/advisories/phpmyfaq-before-remote-code-execution-via-c
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4fv7-8rr6-rf2w
FAQ
What is CVE-2026-66398?
CVE-2026-66398 is a documented vulnerability. phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write a...
How severe is CVE-2026-66398?
CVSS scoring is not yet available for CVE-2026-66398. Check NVD for updates.
Is there a patch for CVE-2026-66398?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.