The vulnerability in phpMyFAQ’s Client::deleteClientFolder allows an administrator with INSTANCE_DELETE permission to supply a URL parameter that contains directory traversal sequences, such as ../../../<path>. The flaw permits the application to resolve the requested directory outside the intended clientFolder scope, leading to recursive deletion of directories anywhere within the web server’s file system. The impact is data loss and potential service disruption, as critical files or configuration directories can be removed. The weakness is a directory traversal flaw categorized as CWE‑73.

The affected product is phpMyFAQ by thorsten. Versions prior to 4.1.2 are vulnerable. Users deploying these versions should verify their installations against the listed version range.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess administrative privileges (INSTANCE_DELETE). If such privileges are obtained, the attacker can delete arbitrary directories via the web interface, causing data corruption or service interruption. Given the moderate CVSS and lack of public exploitation, the overall risk is notable but not extreme; however, the destructive potential warrants swift action.