CVE-2026-66398CWE-494

phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API

Critical · published July 27, 2026

CVSS v4.0
9.4
EPSS
0%
Percentile
26.6
In the wild
Unconfirmed
What it is

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00343 · 26.6th percentile
Weakness
CWE-494 · Download of Code Without Integrity Check
Published
2026-07-27T15:43Z
EPSS history
Timeline
  • 27 JUL 15:43Z
    phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
    cvelistv5