CVE-2026-34728: Path Traversal in phpmyfaq/phpmyfaq

The vulnerability lies in the lack of proper path validation when handling file deletion requests. An attacker can craft a malicious name parameter containing directory traversal sequences (e.g., ../) to bypass intended restrictions. This allows them to specify arbitrary file paths for deletion, potentially impacting critical system files or configuration data. The absence of CSRF protection further exacerbates the risk, as attackers can trigger file deletion without user interaction through Cross-Site Request Forgery attacks. The blast radius extends to any files accessible by the web server process, potentially compromising the entire system.

1. Reserved2026-03-30
2. Published2026-04-01
3. Modified2026-04-06
4. EPSS updated2026-04-10

The primary mitigation is to immediately upgrade phpmyfaq to version 4.1.1 or later, which includes the necessary path validation and CSRF protection. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences in the fileRemove parameter. Additionally, restrict file upload permissions to the minimum necessary and implement strict access controls on the upload directory. Monitor web server access logs for suspicious file deletion attempts.

Last updated

4.1.3recently