p PatchFirst

CVE-2026-111900

CVE-2026-111900 · phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php

This page contains facts from public vulnerability sources. Check the original advisory before updating.

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Affected products and versions

  • phpmyfaq

    Versions
    • ≥ 0, < 4.1.9: Affected (semver)
    • 4.1.9: Not affected (semver)

    Update to 4.1.9

  • phpmyfaq

    Versions
    • ≥ 4.2.0-alpha, < 4.2.0-beta: Affected (semver)
    • 4.2.0-beta: Not affected (semver)

    Update to 4.2.0-beta

Original sources

Check your server →