CVE-2026-45008: phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-15 · updated 2026-10-26
Weakness: CWE-73

Description

phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories. Attackers can submit traversal sequences like https://../../../<path> in the client URL parameter to recursively delete directories outside the intended clientFolder scope.

Affected products

thorsten phpMyFAQ: before 4.1.2 — fixed in 4.1.2

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.2. Check the vendor advisory for mitigations.

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gh9p-q46p-57g2
https://www.vulncheck.com/advisories/phpmyfaq-path-traversal-in-client-deleteclientfolder-via-url-parameter

Get alerted when CVE-2026-45008 or the next vulnerability affects your stack