CVE-2026-76210
Received Received - Intake

phpMyFAQ PDF Generation Local File Disclosure via HTML

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.7 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an <img> tag whose src references a local file under the web root's content/ directory (e.g., content/core/config/database.php). When the PDF is generated, phpMyFAQ attempts to read the referenced file; because it is not a valid image the resulting error is converted into an uncaught exception whose stack trace discloses part of the file's contents to any user who triggers the PDF export. By default the disclosed portion is truncated (zend.exception_string_param_max_len), but a larger configured value can result in disclosure of entire files, including database credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76210
EUVD
EUVD-2026-62451

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

phpMyFAQ before version 4.1.7 has a vulnerability where HTML in FAQ answers is not properly sanitized before generating PDFs. An attacker with permission to edit FAQ content can insert an <img> tag pointing to a local file in the web root. When a PDF is generated, the system tries to read the file, fails, and leaks parts of the file's contents in an error stack trace, potentially exposing sensitive data like database credentials.

Detection Guidance

To detect this vulnerability, check if your phpMyFAQ version is before 4.1.7. Review FAQ entries for suspicious <img> tags with src attributes pointing to local files under the content/ directory. Monitor PDF export errors for stack traces that may leak file contents.

Impact Analysis

If you use phpMyFAQ versions before 4.1.7, an attacker with FAQ editing rights could access sensitive files on your server by exploiting this flaw during PDF generation. This could lead to exposure of database credentials, configuration files, or other confidential data stored in the web root.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Exposure of database credentials or configuration files may result in non-compliance, potential data breaches, and regulatory penalties.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.7 or later. Sanitize FAQ HTML content before PDF generation by implementing cleanUpContent() in the PDF export module. Restrict access to FAQ editing to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76210. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart