CVE-2025-69200 HIGH

CVE-2025-69200: phpMyFAQ has unauthenticated config backup download via /api/setup/backup

Vendor Thorsten
Product phpMyFAQ
Weakness CWE-202
Published December 29, 2025
Last update December 29, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.

Key dates

02Disclosure timeline

December 29, 2025 CVE published
December 29, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-64504 Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs CVE-2023-0785 SourceCodester Best Online News Portal check_availability.php information exposure CVE-2021-32743 Passwords used to access external services inadvertently exposed through API CVE-2023-20215 CVE-2021-1372 Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure Vulnerability