CVE-2026-66398
Received Received - Intake

Remote Code Execution in phpMyFAQ via Malicious Configuration Update

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulnCheck

Description
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-66398
EUVD
EUVD-2026-49331

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.6 (exc)
phpmyfaq phpmyfaq 4.1.5
phpmyfaq phpmyfaq 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-494 The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

phpMyFAQ before v4.1.6 has a remote code execution vulnerability in its configuration API. Authenticated administrators with specific privileges can exploit this by uploading a malicious ZIP file as an attachment, then manipulating the upgrade.lastDownloadedPackage setting to point to the file's path. When the updater extracts this file into the application root, it allows arbitrary PHP code execution as the web server user.

Detection Guidance

Check for unauthorized PHP files in the application root directory, especially those recently modified. Inspect the upgrade.lastDownloadedPackage setting in the phpMyFAQ configuration for suspicious paths. Review web server access logs for unusual attachment uploads or ZIP file extractions.

Impact Analysis

This vulnerability allows attackers with administrative access to execute arbitrary code on your server. This could lead to full system compromise, data theft, unauthorized access to sensitive information, or disruption of services. The impact depends on the server's role and the data it handles.

Compliance Impact

This vulnerability could lead to unauthorized access or exfiltration of sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. Organizations may face legal penalties, reputational damage, and loss of trust if such breaches occur due to unpatched systems.

Mitigation Strategies

Upgrade phpMyFAQ to v4.1.6 or later immediately. Remove any unauthorized PHP files from the application root. Restrict CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to only trusted administrators. Monitor for signs of compromise such as unexpected file writes or web shell activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66398. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart