CVE-2026-66398 CRITICAL

CVE-2026-66398: phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API

Vendor Thorsten
Product phpMyFAQ
Weakness CWE-494 · Download without integrity check
Published July 27, 2026
Last update July 28, 2026
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.

Key dates

02Disclosure timeline

July 27, 2026 CVE published
July 28, 2026 Record updated