logo

Database

Lack of data validation - Path Traversal In phpmyfaq/phpmyfaq

Description

Duplicate Advisory: phpMyFAQ: Path traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-gh9p-q46p-57g2. This link is maintained to preserve external references.

Original Description

phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories. Attackers can submit traversal sequences like https://../../../ in the client URL parameter to recursively delete directories outside the intended clientFolder scope.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. NVD-2026-450082. GHSA-gh9p-q46p-57g23. GCVE-GHSA-rmqr-h98c-qg2m

References

1. https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gh9p-q46p-57g22. https://www.vulncheck.com/advisories/phpmyfaq-path-traversal-in-client-deleteclientfolder-via-url-parameter

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.