Description

phpMyFAQ before 4.1.7 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an <img> tag whose src references a local file under the web root's content/ directory (e.g., content/core/config/database.php). When the PDF is generated, phpMyFAQ attempts to read the referenced file; because it is not a valid image the resulting error is converted into an uncaught exception whose stack trace discloses part of the file's contents to any user who triggers the PDF export. By default the disclosed portion is truncated (zend.exception_string_param_max_len), but a larger configured value can result in disclosure of entire files, including database credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T14:17:46.510Z",
  "pubdate": "2026-08-19T14:17:46.510Z",
  "executiveSummary": "An information disclosure vulnerability exists in phpMyFAQ before 4.1.7, stemming from inadequate HTML sanitization in FAQ answers prior to PDF generation via TCPDF.\nThe vulnerability allows an authenticated attacker with permissions to create or edit FAQ content to induce local file inclusion behavior through crafted HTML elements.\nSuccessful exploitation results in the disclosure of sensitive server-side files, including database configuration credentials stored within the web root.\nThe impact depends on the PHP runtime configuration, specifically the zend.exception_string_param_max_len directive, which can limit or fully expose the contents of targeted files within uncaught exception stack traces.\nAttack execution requires low network exposure combined with valid administrative or editorial privileges within the phpMyFAQ application to supply malicious input and subsequently trigger the PDF export mechanism.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient sanitization of HTML input supplied within FAQ answers. When a user requests a PDF export of an affected FAQ entry, phpMyFAQ utilizes the TCPDF library to render the document.\nAn attacker possessing permissions to create or edit FAQ content can inject an <img> HTML tag into the answer payload. The src attribute of this injected tag is crafted to reference a local file residing within the web root's content/ directory, such as content/core/config/database.php.\nDuring the PDF generation lifecycle, the application attempts to read the locally referenced file to process it as an image resource. Because the targeted file is not a valid image format, the underlying parsing operation fails and generates an error.\nThis error is subsequently converted into an uncaught exception. The resulting exception stack trace captures and exposes a portion of the file's contents, which is then rendered and disclosed to any user who triggers the PDF export functionality.\nThe extent of the data disclosure is directly influenced by the PHP configuration parameter zend.exception_string_param_max_len. By default, this value truncates the disclosed string portion; however, if configured with a larger value, the application can leak entire files, yielding critical secrets such as database credentials.\nThe attack vector requires authentication and specific privileges (content creation or editing access) within phpMyFAQ, operating over standard web protocols."
}