PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-66398 thorsten CVE debrief

CVE-2026-66398 is a remote code execution vulnerability in phpMyFAQ before v4.1.6. The vulnerability exists in the configuration API and allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can exploit this by uploading a malicious ZIP file as an attachment, pointing the updater configuration to its stored path, and extracting it into the application root to achieve code execution as the web server user. Administrators and users of phpMyFAQ versions before v4.1.6 should be aware of this vulnerability and take immediate action to update to the latest version.

Vendor
thorsten
Product
phpMyFAQ
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-27
Original CVE updated
2026-07-27
Advisory published
2026-07-27
Advisory updated
2026-07-27

Who should care

Administrators and users of phpMyFAQ versions before v4.1.6 should be aware of this vulnerability and take immediate action to update to the latest version. Additionally, security teams and vulnerability managers should prioritize this CVE for patching and monitoring. IT teams responsible for maintaining phpMyFAQ installations should review and implement the recommended actions to mitigate the vulnerability.

Technical summary

The vulnerability is caused by inadequate input validation and insecure deserialization in the configuration API of phpMyFAQ. Specifically, the upgrade.lastDownloadedPackage setting can be manipulated by authenticated administrators to write arbitrary PHP files. This can be exploited by uploading a malicious ZIP file as an attachment and extracting it into the application root. The issue affects phpMyFAQ versions before v4.1.6, allowing attackers with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to achieve code execution as the web server user.

Defensive priority

High

Recommended defensive actions

  • Update phpMyFAQ to version 4.1.6 or later
  • Restrict CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to trusted administrators
  • Monitor for suspicious activity and unusual file modifications
  • Implement additional security controls, such as web application firewalls and intrusion detection systems
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-27T16:18:12.493Z and last modified on 2026-07-27T17:16:41.983Z. The NVD entry is currently 9.4, CRITICAL. Limited information is available about the specific details of the vulnerability and its exploitation. The vulnerability exists in the configuration API and allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-27T16:18:12.493Z and has not been modified since then.