Domainxtech

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.5 **Description** An authenticated path traversal issue exists in the `concatenatePaths()` function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path resolution logic uses `strpos()` to locate the substring "content" within a user-controlled path; if "content" is absent, the function returns false, which is cast to 0 as an integer, preserving the attacker-controlled path. This path is then passed to `file get contents()` without canonicalization or root-directory containment validation, potentially allowing the reading of files outside the intended content directory. **Recommendations** Update phpMyFAQ to version 4.1.5 or later.