CVE-2026-76212
Received Received - Intake

PostgreSQL LIKE Wildcard Bypass in phpMyFAQ

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character ('=') in the Search/Database/Pgsql.php backend while escapeLikeWildcards() escapes user input with the '|' prefix. As a result, wildcard escaping is a no-op and user-supplied % and _ characters remain active LIKE wildcards. An unauthenticated attacker can submit such characters in the public FAQ search form to force maximally broad pattern matches and expensive sequential scans, resulting in a denial of service. The PDO PostgreSQL backend is not affected, and quotes remain escaped so this does not enable quote-breaking SQL injection or data exfiltration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76212
EUVD
EUVD-2026-62453

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

phpMyFAQ before version 4.1.7 has a flaw in its PostgreSQL search backend when using the native pgsql PHP extension. The LIKE ESCAPE character is incorrectly set to '=' while user input is escaped with a '|' prefix. This makes wildcard characters like % and _ remain active in search queries, allowing unauthenticated attackers to perform broad searches that cause expensive database scans and denial of service.

Detection Guidance

To detect this vulnerability, check if your phpMyFAQ instance uses PostgreSQL with the native pgsql PHP extension and is running version before 4.1.7. Inspect the Search/Database/Pgsql.php file for the incorrect LIKE ESCAPE character setting.

Impact Analysis

If you use phpMyFAQ with PostgreSQL via the native pgsql extension before version 4.1.7, an attacker could exploit this to slow down or crash your database by submitting search queries with wildcard characters. This could disrupt your FAQ service and require manual intervention to restore normal operations.

Compliance Impact

This vulnerability primarily impacts system availability through denial-of-service conditions caused by inefficient database queries. It does not directly expose or leak sensitive data, nor does it allow unauthorized access or modification of data. Therefore, it is unlikely to directly violate GDPR or HIPAA compliance requirements, which focus on data confidentiality, integrity, and availability. However, prolonged unavailability could indirectly affect compliance if critical systems or data access are disrupted.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.7 or later. If using PostgreSQL, switch to the PDO PostgreSQL backend to avoid this issue. Ensure wildcard characters in search inputs are properly escaped.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76212. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart