Security Advisory

CVE-2026-66398

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-27 15:43:48

Last updated 2026-07-28 01:06:34

Assigner VulnCheck

CVSS score not scored

State PUBLISHED

Description

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.

← Browse all CVEs View on cve.org ↗