Low severityNVD Advisory· Published Jun 8, 2026· Updated Jun 9, 2026

CVE-2026-48488

Description

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
thorsten/phpmyfaqPackagist	< 4.1.4	4.1.4
phpmyfaq/phpmyfaqPackagist	< 4.1.4	4.1.4

Affected products

PhpMyAdmin/Phpmyfaqllm-create
Range: <4.1.4

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-58fg-62fg-3fcjghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-48488ghsaADVISORY
github.com/thorsten/phpMyFAQ/commit/1aa9be6f8a2fa5c527c983826205229fc3129718nvdWEB
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcjnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000