CVE-2026-75920

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6

Description The software writes content backup ZIP archives to the web-accessible document root at the endpoint 'content.zip', which exposes sensitive files such as database credentials. Unauthenticated attackers can use a race condition—a situation where the outcome depends on the sequence or timing of uncontrollable events—by sending concurrent requests to download the temporary ZIP file before it is deleted. Additionally, attackers can exploit Cross-Site Scripting (XSS)—a flaw allowing the injection of malicious scripts into trusted websites—in administrative contexts to trigger authenticated backups and retrieve the archive.

Recommendations Update phpMyFAQ to version 4.1.6 or later.