{"id":"CVE-2026-57961","aliases":["GHSA-88g4-74f3-63x9"],"url":"https://o3.security/vulnerability/CVE-2026-57961","summary":"phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function","details":"phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path resolution logic locates the substring \"content\" within a user-controlled path using strpos(); when \"content\" is absent, strpos() returns false, which becomes 0 when cast to an integer, preserving the entire attacker-controlled path. This path is later passed to file_get_contents() without canonicalization or root-directory containment validation, which may allow reading of files outside the intended content directory.","published":"2026-07-10T13:58:00.282Z","modified":"2026-08-12T03:51:09.321466254Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"thorsten/phpmyfaq","fixedVersion":"4.1.5"},{"ecosystem":"Packagist","name":"phpmyfaq/phpmyfaq","fixedVersion":"4.1.5"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57961.json"},{"type":"ADVISORY","url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-88g4-74f3-63x9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57961"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/phpmyfaq-authenticated-path-traversal-in-pdf-export-via-concatenatepaths-function"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:09.321466254Z"}}