Security Advisory 2026-08-04
Multiple vulnerabilities in phpMyFAQ
- Issued on:
- 2026-08-04
- Software:
- phpMyFAQ <= 4.1.6
- Risk:
- High
- Platforms:
- all
The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.6 and earlier.
Description
High severity
The WebAuthn login flow never persists the challenge it issues, so the replay guard never runs. An attacker who captures a valid assertion can replay it to authenticate as the victim.
The brute-force throttle protecting the administration two-factor prompt is scoped to the session. An attacker who starts with a fresh cookie jar resets the counter and can guess TOTP codes without any effective rate limit.
An LDAP login silently reactivates a local account that an administrator has blocked, and the state change is not written to the audit log, so a revoked user regains access unnoticed.
The remember-me cookie is issued before the second factor has been verified. An attacker who knows only the password can keep the cookie from the incomplete login and use it to return as the fully authenticated user, bypassing two-factor authentication.
Glossary input is escaped before it is truncated. Truncation can cut an escape sequence in half, which allows an authenticated user to inject SQL into the resulting query.
A tracking file below the document root is served without authentication and contains password reset tokens, allowing an unauthenticated visitor to take over the accounts those tokens belong to.
Moderate severity
The public PDF export does not check whether a FAQ record is active, so an unauthenticated visitor can retrieve the title and solution of drafts and unpublished entries.
Comment endpoints do not verify authorization for the parent FAQ record, exposing the comments, the personal data of the commenters, and attachment metadata of restricted records.
The PostgreSQL search backend declares the wrong LIKE ESCAPE character, which makes the wildcard-escaping fix ineffective on that backend.
The administration API endpoints that read the LDAP, Elasticsearch, OpenSearch, and dashboard configuration only require a login instead of the CONFIGURATION_EDIT permission, so any authenticated user can read these settings.
An authenticated FAQ editor can reference a local file as an image in a FAQ entry and have the PDF export embed and disclose its contents.
The registration endpoints remain reachable even when security.enableRegistration is turned off, so visitors can still create accounts on an installation that is meant to be closed.
The content backup is written as a ZIP archive into the web-accessible document root, where anyone who guesses or learns its name can download the full contents of the installation.
The backup, database migration, and maintenance mode endpoints can be reached without authentication, allowing an unauthenticated attacker to export data or put the installation into maintenance mode.
Solution
The phpMyFAQ Team has released the new phpMyFAQ version 4.1.7, which fixes the vulnerabilities. All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.
Workaround
There's no workaround except installing phpMyFAQ 4.1.7.
Thanks
The phpMyFAQ team would like to thank Arpit Jain, Thomas Youssef Wilson, pavelkohout396, and kevinnivekkevin for the responsible disclosures of these vulnerabilities.