CVE-2026-66398 — Vulnerability intelligence
thorsten — phpMyFAQ
Published:
- CVSS
- 9.4
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.