Medium severity5.3NVD Advisory· Published Aug 19, 2026· Updated Sep 1, 2026
CVE-2026-75920
CVE-2026-75920
Description
phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <4.1.6
Patches
Vulnerability mechanics
References
2- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8hmh-mrx6-pqvfnvdExploitVendor Advisory
- www.vulncheck.com/advisories/phpmyfaq-before-information-disclosure-via-backup-zipnvdThird Party Advisory
News mentions
1- PhpMyFAQ: 14 Vulnerabilities Including Auth Bypass Patched in Single DisclosureVypr Intelligence · Aug 19, 2026