CVE-2026-48488

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.4

Description Attachment passwords are hashed using SHA-1, which is a cryptographically broken algorithm susceptible to collision attacks. A collision attack occurs when two different inputs produce the same hash output. This flaw allows an attacker to generate SHA-1 collisions to bypass attachment protection and increases the risk of password cracking if the database is compromised, with estimated cracking times of less than one minute for standard attachments. The issue is located in the file phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php.

Recommendations Update to version 4.1.4.