PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-76212 thorsten CVE debrief

The CVE-2026-76212 vulnerability affects phpMyFAQ installations using PostgreSQL via the native pgsql PHP extension. An incorrect LIKE ESCAPE character declaration allows unauthenticated attackers to submit malicious input, potentially causing denial of service attacks. System administrators and security teams should review and apply patches, verify input validation, and consider alternative backends. The CVE record was published on 2026-08-19T14:17:46.807Z. To verify, review the Search/Database/Pgsql.php backend and ensure the escapeLikeWildcards() function is properly implemented. Check the public FAQ search form for potential input validation weaknesses. This issue does not affect the PDO PostgreSQL backend.

Vendor
thorsten
Product
phpMyFAQ
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-19
Original CVE updated
2026-08-25
Advisory published
2026-08-19
Advisory updated
2026-08-25

Who should care

System administrators and security teams responsible for phpMyFAQ installations, especially those using PostgreSQL via the native pgsql PHP extension, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The phpMyFAQ application, when configured to use PostgreSQL via the native pgsql PHP extension, is vulnerable to a denial of service attack. The issue arises from the incorrect declaration of the LIKE ESCAPE character in the Search/Database/Pgsql.php backend. This allows an unauthenticated attacker to submit malicious input to the public FAQ search form, potentially causing maximally broad pattern matches and expensive sequential scans.

Defensive priority

Organizations using phpMyFAQ with PostgreSQL via the native pgsql PHP extension should prioritize patching to prevent potential denial of service attacks.

Recommended defensive actions

  • Review and apply the patch for phpMyFAQ version 4.1.7 or later
  • Verify the escapeLikeWildcards() function implementation in Search/Database/Pgsql.php
  • Monitor the public FAQ search form for potential input validation weaknesses
  • Consider using the PDO PostgreSQL backend as an alternative
  • Perform a thorough review of the system configuration and update as necessary
  • Ensure that all instances of phpMyFAQ are running the latest version
  • Continuously monitor the system for potential security threats

Evidence notes

The CVE description indicates that phpMyFAQ before 4.1.7 is vulnerable to a denial of service attack when configured to use PostgreSQL via the native pgsql PHP extension. The issue arises from the incorrect declaration of the LIKE ESCAPE character, which allows user-supplied % and _ characters to remain active as LIKE wildcards. To verify, review the Search/Database/Pgsql.php backend and ensure the escapeLikeWildcards() function is properly implemented. Check the public FAQ search form for potential input validation weaknesses.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-76212 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-76212

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-76212 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76212

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.