CVE-2026-45008 MEDIUM

CVE-2026-45008: phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter

Vendor Thorsten

Product phpmyfaq

Weakness CWE-73

Published May 15, 2026

Last update May 28, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories. Attackers can submit traversal sequences like https://../../../<path> in the client URL parameter to recursively delete directories outside the intended clientFolder scope.

Key dates

02Disclosure timeline

May 15, 2026 CVE published

May 28, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-45008 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/73.html AskarLabs — CWE-73 write-up External Control of File Name or Path

Related vulnerabilities

04Related CVE

CVE-2025-2004 Simple WP Events <= 1.8.17 - Unauthenticated Arbitrary File Deletion CVE-2022-2638 Export All URLs < 4.4 - Admin+ Arbitrary System File Removal CVE-2024-10672 Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion CVE-2026-3892 Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter CVE-2024-12875 Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download