CVE-2026-66398— phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-66398
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
Source: CVE Program / CVE List V5
Vulnerability Description
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
下载代码缺少完整性检查
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-66398
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCVerified env Premium
Qwen3.6-35B-A3B · 10413 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-66398
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-66398 (2)
Same Patch Batch · thorsten · 2026-07-27 · 3 CVEs total
| CVE-2026-66397 | 8.6 HIGH | phpMyFAQ before 4.1.6 Path Traversal via category image deletion |
| CVE-2026-66399 | 6.5 MEDIUM | phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership |
IV. Related Vulnerabilities
Same product: phpMyFAQ
- CVE-2026-66399
phpMyFAQ before 4.1.6 Privilege Escalation via Group Members - CVE-2026-66397
phpMyFAQ before 4.1.6 Path Traversal via category image dele - CVE-2026-57996
phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard - CVE-2026-57994
phpMyFAQ - Information Disclosure of Inactive FAQ Content vi - CVE-2026-57961
phpMyFAQ - Authenticated Path Traversal in PDF Export via co
Same vendor: thorsten
- CVE-2026-66399
phpMyFAQ before 4.1.6 Privilege Escalation via Group Members - CVE-2026-66397
phpMyFAQ before 4.1.6 Path Traversal via category image dele - CVE-2026-49205
phpMyFAQ: Missing userHasPermission() in 4 API write endpoin - CVE-2026-48488
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing - CVE-2026-35676
phpMyFAQ - Unauthenticated Password Reset via User Password
Same weakness: CWE-494
- CVE-2021-47987
Parse Server - Arbitrary Code Execution via Malicious Versio - CVE-2021-47986
Parse Server - Unreviewed Code Execution via Malicious Versi - CVE-2026-9037
Download of code without integrity check in XCharge C6 - CVE-2026-9089
ConnectWise Automate Agent 安全漏洞 - CVE-2026-42249
Remote Code Execution in Ollama via Update Mechanism
V. Comments for CVE-2026-66398
No comments yet