VULNERABILITY INTELLIGENCE

CVE-2026-66398

CVSS score9.4 CRITICAL

EPSS probability0.41%

CISA KEVNot currently listed

Published2026-07-27

Last modified2026-10-24

Description

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.