CVE-2026-76212: phpmyfaq Argument Injection

Vulnerability summary

CVE-2026-76212 is a medium (CVSS 6.9) Argument Injection vulnerability in phpmyfaq. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-08-2026
   PublishedVulnerability first disclosed.
2. 25-08-2026
   Last modifiedVulnerability information updated.

Description

phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character ('=') in the Search/Database/Pgsql.php backend while escapeLikeWildcards() escapes user input with the '|' prefix. As a result, wildcard escaping is a no-op and user-supplied % and _ characters remain active LIKE wildcards. An unauthenticated attacker can submit such characters in the public FAQ search form to force maximally broad pattern matches and expensive sequential scans, resulting in a denial of service. The PDO PostgreSQL backend is not affected, and quotes remain escaped so this does not enable quote-breaking SQL injection or data exfiltration.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.