CVE-2026-66397
Received Received - Intake

Path Traversal in phpMyFAQ Leading to Arbitrary File Deletion

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete(). Attackers can delete the database.php configuration file to disable the installation gate and access the public setup wizard to create new superadmin accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-66397
EUVD
EUVD-2026-49330

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in phpMyFAQ versions before 4.1.6. It allows authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in the existing_image field during category updates. The flaw occurs because path traversal sequences like ../ are not properly stripped, enabling deletion of files outside the intended directory. Attackers can remove the database.php configuration file to disable the installation gate and access the setup wizard to create new superadmin accounts.

Detection Guidance

Check phpMyFAQ versions for affected releases (≤4.1.5 or 4.2.0-alpha). Inspect web server logs for suspicious category update requests containing path traversal sequences like ../ in the existing_image field. Monitor for unexpected file deletions, especially database.php in the core/config directory.

Impact Analysis

If exploited, this vulnerability allows attackers with admin access to delete critical files, potentially leading to full application takeover. Attackers can remove the database.php file to bypass the installation gate and access the setup wizard without authentication. This enables them to create new superadmin accounts, gaining complete control over the phpMyFAQ application and its data.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A successful exploit may result in unauthorized data exposure, access, or modification, leading to regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.6 or later immediately. Review and remove any unauthorized superadmin accounts created via the setup wizard. Restore the database.php file from a backup if deleted. Implement strict input validation for file paths in category updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66397. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart