Medium severity5.3NVD Advisory· Published Aug 19, 2026

CVE-2026-75920

Description

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.

Affected products

PhpMyAdmin/Phpmyfaqllm-create
Range: <4.1.6

Patches

Vulnerability mechanics

References

github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8hmh-mrx6-pqvfnvd
www.vulncheck.com/advisories/phpmyfaq-before-information-disclosure-via-backup-zipnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000