CVE-2026-66398 | phpMyFAQ before v4.1.6 contains a remote code execution vuln… | CVSS 9.4 CRITICAL

Description

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.

Metadata

CVE ID: CVE-2026-66398
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-26 12:22 UTC
Published: 2026-07-27 15:43 UTC
Last updated: 2026-07-28 01:06 UTC
Primary CWE: CWE-494
Download of Code Without Integrity Check
Vendor / Product: thorsten / phpMyFAQ
Sources: cve.org · NVD

Severity & Metrics

9.4 CRITICAL CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
thorsten	phpMyFAQ	—	0 < 4.1.6, 4.1.6

Weakness (CWE)

CWE	Source	Description
CWE-494	cna	Download of Code Without Integrity Check

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.4	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (2)

GitHub Security Advisory (GHSA-4fv7-8rr6-rf2w) https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-4fv7-8rr6-rf2w
VulnCheck Advisory: phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API https://www.vulncheck.com/advisories/phpmyfaq-before-remote-code-execution-via-configuration-api