Vulnerabilities CVE-2026-66398

CVE-2026-66398

Critical

Open

TLP:CLEAR

phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.

Details

CVSS Score: 9.4
EPSS Score ⓘ: 0.24%

15.6th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Confidence: 90%
Published: Jul 27, 2026
Last Modified: Jul 28, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.