Description

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T14:17:42.527Z",
  "pubdate": "2026-08-19T14:17:42.527Z",
  "executiveSummary": "An information disclosure vulnerability affects phpMyFAQ prior to v4.1.6, involving the insecure generation and storage of content backup ZIP archives within the web-accessible document root.\nThe vulnerability allows unauthorized retrieval of sensitive system data, including database credentials, posing a severe risk to confidentiality and overall system integrity.\nThe affected product is phpMyFAQ versions prior to v4.1.6, which improperly place the generated content.zip file in a publicly reachable directory.\nRisk implications include full database compromise, exposure of administrative secrets, and potential lateral movement or further exploitation of the underlying web infrastructure.\nAttacker capabilities range from unauthenticated remote actors to authenticated administrative contexts, depending on the chosen exploitation vector.\nExploitation requirements involve either winning a race condition via concurrent requests against temporary unauthenticated export routines or executing Cross-Site Scripting (XSS) payloads within administrative contexts to trigger and retrieve authenticated backups.",
  "technicalDetails": "The root cause of the vulnerability stems from phpMyFAQ writing content backup ZIP archives directly to the web-accessible document root under the predictable file path content.zip.\nThe affected component is the application backup functionality responsible for packaging system content and configuration parameters into a downloadable archive.\nAffected versions comprise all phpMyFAQ installations prior to v4.1.6.\nNetwork exposure is remote, as the document root is directly accessible via standard HTTP/HTTPS protocols over the network.\nAuthentication requirements vary by attack vector: unauthenticated attackers can target the export mechanism, while the secondary vector requires administrative context exploitation via XSS.\nPrivilege requirements are initially none for the race condition vector, or require administrative privileges implicitly obtained via exploitation of XSS in admin contexts.\nThe exploitation method leverages two distinct attack flows. In the first vector, unauthenticated attackers race concurrent HTTP requests to download the temporary content.zip file before the application can securely delete or move it. In the second vector, attackers exploit Cross-Site Scripting (XSS) vulnerabilities within administrative contexts to trigger authenticated backups programmatically and subsequently retrieve the resulting archive.\nPayload behavior involves targeting the predictable content.zip file path within the web root.\nPost-exploitation impact includes the recovery of sensitive files containing database credentials and other critical configuration parameters, facilitating unauthorized database access and complete system compromise."
}