The MediaBrowserController in phpMyFAQ concatenates a user-supplied filename to the base upload directory without validating for directory traversal characters. Because the sanitization filter only escapes a few HTML characters, an attacker can craft a file name containing sequences such as '../' and prove that the endpoint will delete the referenced file. The endpoint also lacks CSRF protection, allowing the deletion to be triggered through a forged request from an authenticated user. This flaw gives an attacker the ability to remove any file within the upload directory, potentially disrupting FAQ content, wiping backups, or deleting malicious files. The weakness is classified as a Path Traversal (CWE‑22) and can severely compromise the integrity and availability of the application. The single primary impact is destructive file removal, which can lead to data loss and service disruption.

The issue affects installations of phpMyFAQ running any version older than 4.1.1. All self-hosted deployments from Thorsten that have not applied the 4.1.1 update are vulnerable. Versions 4.1.1 and beyond have validated paths and added CSRF checks, eliminating this flaw.

The CVSS base score of 8.7 signals a high severity. Although the EPSS score is below 1 %, the lack of path validation and CSRF protection means the vulnerability can be exploited via a simple CSRF request from an authenticated user. The risk is significant for any site where file deletion is permitted. The flaw is not listed in the CISA KEV catalog, but its ease of exploitation warrants immediate attention.