The MediaBrowserController component processes file deletion requests without validating the supplied filename. The filter applied only sanitizes HTML special characters and does not guard against path traversal characters such as '..'. As a result, an attacker can supply a filename that navigates outside the intended upload directory and cause deletion of arbitrary files stored on the web server. The deletion can be triggered through a CSRF request as no anti‑CSRF tokens are checked, allowing an attacker to trigger the action from a malicious website. The primary impact is loss of data and potential disruption of the FAQ application.

Vendors: Thorsten under the phpMyFAQ project. Product: phpMyFAQ. All releases prior to version 4.1.1 are affected. The patch was released in 4.1.1 to address this flaw.

The CVSS base score is 8.7, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable from the web interface using a crafted CSRF payload; an attacker only needs to coerce a valid user into visiting a malicious site. This makes the risk significant for systems where the phpMyFAQ application is publicly exposed and access to the file remove action is not restricted.