Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-34728: phpMyFAQ can delete arbitrary files via media browser

CVE-2026-34728 · published 7 months ago

Summary

Versions of phpMyFAQ before 4.1.1 let an attacker trick the media browser into deleting files on the server because it does not check the file path properly. The flaw can also be triggered from another website without user interaction. Updating to phpMyFAQ 4.1.1 or later closes the issue.

What to do

Update phpmyfaq phpmyfaq to version 4.1.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	phpmyfaq	phpmyfaq	<= 4.1.0 Fix: upgrade to 4.1.1
–	phpmyfaq	phpmyfaq	< 4.1.1 `cpe:2.3:a:phpmyfaq:phpmyfaq::::::::`

Original advisory text

phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser. When the fileRemove action is triggered, the user-supplied name parameter is concatenated with the base upload directory path without any path traversal validation. The FILTER_SANITIZE_SPECIAL_CHARS filter only encodes HTML special characters (&, ', ", <, >) and characters with ASCII value < 32, and does not prevent directory traversal sequences like ../. Additionally, the endpoint does not validate CSRF tokens, making it exploitable via CSRF attacks. This issue has been patched in version 4.1.1.

References

https://github.com/advisories/GHSA-38m8-xrfj-v38x
https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1 Product
https://nvd.nist.gov/vuln/detail/CVE-2026-34728 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34728... Vendor Advisory
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-38m8-xrfj-v38x Exploit Mitigation Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published2 Apr 2026

Updated4 Nov 2026

First seen1 Apr 2026

Sources

GHSA-38m8-xrfj-v38x · GHSA

CVE-2026-34728 · NVD

CVE-2026-34728 · OSV

Track software like this

Free during beta