phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

The impact of this vulnerability is significant. An attacker can leverage it to delete critical files on the server hosting phpmyfaq/phpmyfaq, potentially leading to denial of service or even complete system compromise. The lack of CSRF protection exacerbates the risk, as attackers can trigger file deletion without user interaction. Successful exploitation could result in the loss of configuration files, database connections, or even core application files, disrupting service and potentially exposing sensitive data. The absence of proper path validation means an attacker can traverse directories and delete files outside the intended upload directory.

Websites and applications utilizing phpmyfaq versions 4.1.0-beta.2 and earlier are at risk. Shared hosting environments where users have the ability to upload and manage media files are particularly vulnerable, as attackers could potentially leverage this vulnerability to compromise other users' accounts or the entire server.

• php: Examine web server access logs for requests to /phpmyfaq/media/browser/index.php?fileRemove=../… or similar patterns. • php: Use grep to search for the vulnerable code within the MediaBrowserController::index() function in the phpmyfaq codebase. • generic web: Monitor for unusual file deletion activity in the phpmyfaq media directory. • linux / server: Use journalctl to filter for errors related to file access or deletion within the phpmyfaq directory.

1. 2026-04-01Disclosure

   disclosure

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-01
3. Geändert2026-04-06
4. EPSS aktualisiert2026-04-10

The primary mitigation is to immediately upgrade phpmyfaq/phpmyfaq to version 4.1.1 or later. If upgrading is not immediately feasible, implement a temporary workaround by restricting file upload permissions to the phpmyfaq user and directory. Additionally, implement a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences (e.g., ../) in the name parameter of the fileRemove action. Consider adding CSRF protection to the fileRemove endpoint as a further preventative measure. After upgrading, verify the fix by attempting a file deletion request with a malicious name parameter containing directory traversal sequences; the request should be rejected.

Zuletzt aktualisiert

4.1.3kürzlich