PT-2026-41355 · Phpmyfaq · Phpmyfaq

Adrgs · CVE-2026-45008 · Published 2026-05-06 · Updated 2026-05-15

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.2

Description A path traversal issue exists in the deleteClientFolder() function. This allows administrators with the INSTANCE DELETE permission to delete arbitrary directories. An attacker can achieve this by submitting traversal sequences in the client URL parameter to recursively delete directories outside the intended client folder scope.

Recommendations Update to version 4.1.2 or later. As a temporary workaround, restrict the INSTANCE DELETE permission to only highly trusted administrators.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-45008

GHSA-GH9P-Q46P-57G2

GHSA-RMQR-H98C-QG2M

Affected Products

Phpmyfaq

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45008.json · Exploit
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gh9p-q46p-57g2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gh9p-q46p-57g2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45008 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rmqr-h98c-qg2m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45008 · Security Note
• https://github.com/thorsten/phpMyFAQ · Note
• https://vulncheck.com/advisories/phpmyfaq-path-traversal-in-client-deleteclientfolder-via-url-parameter · Note