CVE-2026-66398
phpMyFAQ versions older than 4.1.6 let an authenticated administrator upload a malicious ZIP file and write arbitrary PHP files to the web root, enabling remote code execution. The flaw lies in the configuration API that processes the upgrade.lastDownloadedPackage setting. Because only admin privileges are needed, the risk is high.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
phpMyFAQ installations before version 4.1.6, specifically administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD rights.
Real-world impact
An attacker who can log in as an administrator can upload a crafted ZIP, have the system extract it into the web directory, and run arbitrary PHP code as the web server user, potentially taking full control of the site.
Why this severity
The CVSS score of 9.4 reflects a remote vulnerability that requires low effort and grants attackers high privileges, allowing them to write and execute code. The impact is a complete compromise of the web application.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources