CVE-2026-57961

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.5

Description An authenticated path traversal issue exists in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path resolution logic uses strpos() to locate the substring "content" within a user-controlled path; if "content" is absent, the function returns false, which is cast to 0 as an integer, preserving the attacker-controlled path. This path is then passed to file get contents() without canonicalization or root-directory containment validation, potentially allowing the reading of files outside the intended content directory.

Recommendations Update phpMyFAQ to version 4.1.5 or later.