CVE-2026-34728
Description
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser. When the fileRemove action is triggered, the user-supplied name parameter is concatenated with the base upload directory path without any path traversal validation. The FILTER_SANITIZE_SPECIAL_CHARS filter only encodes HTML special characters (&, ', ", <, >) and characters with ASCII value < 32, and does not prevent directory traversal sequences like ../. Additionally, the endpoint does not validate CSRF tokens, making it exploitable via CSRF attacks. This issue has been patched in version 4.1.1.
How to fix
- phpmyfaq phpmyfaq4.1.1 or later
- phpmyfaq/phpmyfaq4.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmyfaq phpmyfaq | v < 4.1.1 | 4.1.1 |
| phpmyfaq/phpmyfaqPackagist | v < 4.1.1 | 4.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.