CVE-2024-29196

phpMyFAQ Path Traversal in Attachments

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments that allows attackers with admin rights to upload malicious files to other locations of the web root. This vulnerability is fixed in 3.2.6.

Affected

thorsten · phpMyFAQ

CVSS v3.1 NVD

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

CVSS v3.1 GITHUB

3.8 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS

0.59% chance of exploitation in the next 30 days, 47th percentile

Published

2024-03-26

Updated

2024-08-05

Proof-of-concept exploits (1)

• thorsten/phpMyFAQ/security/advisories/GHSA-mmh6-5cpf-2c72

Security advisories

• advisories/GHSA-mmh6-5cpf-2c72
• thorsten/phpMyFAQ/commit/7ae2559f079cd5fc9948b6fdfb87581f93840f62

References

• CVE Record
• NVD entry