High severityNVD Advisory· Published Jul 27, 2026· Updated Jul 28, 2026

CVE-2026-66397

Description

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete(). Attackers can delete the database.php configuration file to disable the installation gate and access the public setup wizard to create new superadmin accounts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

PhpMyAdmin/Phpmyfaqllm-create
Range: <4.1.6

Patches

Vulnerability mechanics

References

github.com/thorsten/phpMyFAQ/security/advisories/GHSA-mh9w-5hr8-3272nvd
www.vulncheck.com/advisories/phpmyfaq-before-path-traversal-via-category-image-deletionnvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000