External risk intelligence

phpMyFAQ Configuration API Remote Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-66398

phpMyFAQ is a web-based application designed to be deployed as a public-facing FAQ or knowledge base portal. While the vulnerability requires administrative privileges, the underlying product role is an internet-facing web service, making the attack surface commonly reachable in typical deployments.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a remote code execution vulnerability within the phpMyFAQ configuration API. The issue allows authenticated administrators to write arbitrary PHP files, potentially leading to code execution on the web server. The main concern is confirming if this specific technology is in use and if the necessary administrative access is present.

Allows code execution via file uploads.
Matters if you use this software for public FAQs.
Confirm relevance and exposure for this technology.

Attack Path

How an attacker could exploit the issue

An attacker with administrative privileges could manipulate the configuration API to upload and extract a malicious ZIP file, leading to arbitrary PHP file creation. This allows the attacker to execute code on the server as the web server user.

Authenticated administrator privileges required.
Vulnerability triggered by manipulating upgrade settings.
Risk of arbitrary code execution on server.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, authenticated administrators could execute arbitrary PHP code on the server by uploading a malicious ZIP file and manipulating the updater configuration. This could lead to the web server user's privileges being used to write arbitrary PHP files to the application root.

System data or code could be affected.
Arbitrary file writes via configuration manipulation.
Potential for unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for managing phpMyFAQ deployments. The first practical step is to identify all instances, confirm their reachability and business criticality, locate the accountable owner, and then prioritize remediation efforts based on risk and impact.

Application owners should own the issue.
Verify affected instances and reachability.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is phpMyFAQ?

phpMyFAQ is a popular open-source, database-driven software used to build public-facing FAQ pages and knowledge base portals. It allows organizations to manage and display information for users through a web interface, typically running on a web server with PHP support.

What kind of vulnerability is CVE-2026-66398?

This is a remote code execution vulnerability classified as CWE-494: Download of Code Without Integrity Check. Essentially, the application's configuration API fails to properly validate files, allowing an attacker to trick the system into extracting a malicious package as if it were a legitimate update, which then runs arbitrary code.

How is this vulnerability triggered?

It requires an attacker to already possess specific administrative privileges (CONFIGURATION_EDIT and ATTACHMENT_ADD). The bug is not triggered by public visitors; instead, it occurs when a malicious ZIP file is uploaded as an attachment and the updater configuration is manipulated to point to that file, causing the server to extract it into the application root.

Who should be concerned about this CVE?

Organizations running phpMyFAQ should care, especially because the Halo Surface Signal identifies this as an internet-facing web service. Even though it requires high-level credentials, the product's primary role as a public-facing portal means that if those credentials were compromised, the server could be fully controlled by an attacker.

What should I do if I run phpMyFAQ?

First, inventory your systems to identify all active instances of phpMyFAQ. Confirm which versions are deployed, locate the internal team responsible for maintenance, and prioritize these systems for updates to ensure they are on version 4.1.6 or later, which addresses the flaw in the configuration API.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.