CVE-2026-66397 thorsten CVE debrief

Who should care

Administrators and users of phpMyFAQ versions prior to 4.1.6 should be aware of this vulnerability and take immediate action to update their installations. Additionally, security teams and vulnerability managers should prioritize this CVE for patching and monitoring.

Technical summary

The vulnerability exists in the Image::delete() method of phpMyFAQ before version 4.1.6, where the existing_image field during category updates fails to validate path traversal sequences. This allows authenticated attackers to delete arbitrary files by manipulating the file path. The CVSS score for this vulnerability is 8.6, indicating a high severity level. The vulnerability can be exploited to delete the database.php configuration file, potentially allowing attackers to access the public setup wizard and create new superadmin accounts. However, the exact impact and affected scope are not well-defined in the available sources. Security teams and vulnerability managers should prioritize this CVE for patching and monitoring.

Defensive priority

High

Recommended defensive actions

• Update phpMyFAQ to version 4.1.6 or later
• Review and restrict access to the setup wizard
• Monitor for suspicious file deletion activities
• Implement additional security measures to prevent path traversal attacks
• Perform a thorough review of the system for any potential security breaches
• Ensure that all necessary security patches are applied and up-to-date
• Regularly monitor system logs for any suspicious activity

Evidence notes

The CVE record was published on 2026-07-27T16:18:12.363Z and last modified on 2026-07-27T19:17:23.007Z. The NVD entry is currently in the 'Received' status. Limited information is available about the affected scope and vendor remediation efforts. The vulnerability exists in phpMyFAQ before version 4.1.6. Authenticated attackers can exploit this vulnerability to delete arbitrary files, including the database.php configuration file. This could potentially allow them to access the public setup wizard and create new superadmin accounts. However, the exact impact and affected scope are not well-defined in the available sources.

Official resources