Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-66398— phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API

Quick assessment

Affected
thorsten phpMyFAQ
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 phpMyFAQ 4.1.6 版本之前，其配置 API 中存在一个远程代码执行漏洞。该漏洞允许拥有 CONFIGURATION_EDIT 和 ATTACHMENT_ADD 权限的已认证管理员，通过操纵 upgrade.lastDownloadedPackage 配置项写入任意 PHP 文件。攻击者可以将恶意 ZIP 文件作为附件上传，并将更新器配置指向该文件的存储路径，随后将其解压到应用程序根目录，从而以 Web 服务器用户的身份实现代码执行。

CVSS 9.4 · Critical EPSS 0.34% · P26

Affected Version Matrix 2

VendorProduct Version RangeStatus
thorsten phpMyFAQ < 4.1.6 affected
4.1.6 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-66398

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
Source: CVE Program / CVE List V5
Vulnerability Description
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
下载代码缺少完整性检查
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
thorsten phpMyFAQ 0 ~ 4.1.6 -

II. Public POCs for CVE-2026-66398

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Qwen3.6-35B-A3B · 10413 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-66398

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-66398 (2)

Same Patch Batch · thorsten · 2026-07-27 · 3 CVEs total

CVE-2026-66397 8.6 HIGH phpMyFAQ before 4.1.6 Path Traversal via category image deletion
CVE-2026-66399 6.5 MEDIUM phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership

IV. Related Vulnerabilities

Same product: phpMyFAQ
Same vendor: thorsten
Same weakness: CWE-494

V. Comments for CVE-2026-66398

No comments yet

Leave a comment