Technical impact
The phpMyFAQ application before version 4.1.10 has a server‑side request forgery flaw in its PDF export feature. When generating a PDF, the software fetches images referenced in FAQ answers using outbound HTTP or HTTPS requests. An attacker who can modify FAQ content can embed a URL pointing to any loopback or internal service, causing the application to request that URL and incorporate the response into the PDF. This can expose data from services that are otherwise inaccessible to external users, potentially leaking sensitive configuration or internal APIs.
Affected Systems
The vulnerability affects phpMyFAQ, a FAQ management system developed by Thorsten. All releases prior to 4.1.10 are vulnerable. Users running an affected version should check their installation and apply the latest update when available.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Exploitation is possible through the PDF export function, requiring an attacker who can influence FAQ content – typically a user with editing rights. Once an attacker supplies a malicious image URL, the web server will perform the request, allowing access to internal network addresses, but the flaw does not grant execution of arbitrary code or direct lateral movement beyond the scope of the web server's privileges.
