Authenticated Path Traversal in phpMyFAQ Leading to Arbitrary File Read

Executive Summary

phpMyFAQ versions before 4.1.5 contain an authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php.

A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation.

The vulnerability arises because the path resolution logic uses strpos() to locate the substring "content" in user-controlled paths. When "content" is not found, strpos() returns false, which is cast to 0, causing the entire attacker-controlled path to be preserved.

This path is then passed to file_get_contents() without proper canonicalization or root-directory containment validation, potentially allowing reading of files outside the intended content directory.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated user with FAQ editing privileges to read arbitrary files on the server outside the intended content directory.

Such unauthorized file access can lead to exposure of sensitive information stored on the server, potentially compromising system security or confidentiality.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires a user with FAQ editing privileges to craft malicious HTML image paths that are processed during PDF generation. Detection involves identifying such crafted paths or monitoring PDF generation activities for unusual file access.

Since the issue is in the concatenatePaths() function in src/phpMyFAQ/Export/Pdf/Wrapper.php, you can audit the source code or logs for usage of file_get_contents() with user-controlled paths that lack proper canonicalization.

There are no specific commands provided in the available resources to detect exploitation attempts on the network or system.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade phpMyFAQ to version 4.1.5 or later, where the vulnerability has been patched.

If upgrading immediately is not possible, restrict FAQ editing privileges to trusted users only, as exploitation requires authenticated users with such privileges.

Implement or verify that path canonicalization and root-directory containment checks are in place for any user-controlled paths processed during PDF generation.

• Replace substring-based path anchoring with proper canonicalization.
• Enforce strict root-directory containment checks.
• Use explicit allowlisting of permitted image locations.

Useful 0 Not Useful 0