The phpMyFAQ application before version 4.1.5 contains an authenticated path traversal flaw in the concatenatePaths() function that processes user‑controlled image paths during PDF creation. When the string "content" is absent, the function incorrectly resolves the path arbitrary files outside the intended content directory. The result is that an attacker with FAQ editing privileges can read sensitive files on the server, potentially exposing configuration data orThe CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. Based on the description, the likely attack vector is an authenticated editor does not allow remote code execution. It is not listed in the CISA KEV catalog, but the ability to read arbitrary files compromises confidentiality and could be used in broader attacks.

All installations of phpMyFAQ prior to version 4.1.5 are vulnerable when an editor embeds malicious image paths into FAQ content.

With a CVSS score of 5.1 the vulnerability is considered moderate, but the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog, indicating no publicly known widespread attacks. Successful exploitation requires an authenticated user with FAQ editing privileges, and the attacker must embed malicious image paths that are processed during PDF generation. The path concatenation logic can expose any file on the server that is outside the expected content directory, leading to information disclosure but not immediate remote code execution.