BaseFortify

Publication date: 2026-05-15

Last updated on: 2026-05-28

Assigner: VulnCheck

Description

phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories. Attackers can submit traversal sequences like https://../../../<path> in the client URL parameter to recursively delete directories outside the intended clientFolder scope.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-15

Last Modified

2026-05-28

Generated

2026-06-30

EPSS Evaluated

2026-06-28

NVD

CVE-2026-45008

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions have not been generated yet.

Hi! I’m here to help you understand CVE-2026-45008. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70