CVE-2026-76210: phpmyfaq External Control of File Name or Path

Vulnerability summary

CVE-2026-76210 is a high (CVSS 7.1) External Control of File Name or Path vulnerability in phpmyfaq. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-08-2026
   PublishedVulnerability first disclosed.
2. 21-08-2026
   Last modifiedVulnerability information updated.

Description

phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an <img> tag whose src references a local file under the web root's content/ directory (e.g., content/core/config/database.php). When the PDF is generated, phpMyFAQ attempts to read the referenced file; because it is not a valid image the resulting error is converted into an uncaught exception whose stack trace discloses part of the file's contents to any user who triggers the PDF export. By default the disclosed portion is truncated (zend.exception_string_param_max_len), but a larger configured value can result in disclosure of entire files, including database credentials.

• CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.