Beveiligingsadvies

CVE-2026-66398

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-27 15:43:48

Laatst bijgewerkt 2026-07-28 01:06:34

Toegewezen door VulnCheck

CVSS-score 9.4

Status PUBLISHED

Beschrijving

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.

← Alle CVE's bekijken Bekijk op cve.org ↗