The phpMyFAQ application before version 4.1.5 contains an authenticated path traversal flaw in the concatenatePaths() function. During PDF generation, user-controlled image paths can be crafted such that the path resolution logic incorrectly interprets the location. When the substring "content" is absent, the strpos() index is cast to 0, allowing the entire attacker-controlled path to be passed to file_get_contents(). Without canonicalization or directory containment checks, this flaw – classified as CWE-22, Path Traversal – can be used by an editor to read arbitrary files outside the intended content directory, exposing configuration data or other sensitive files on the server.

All installations of phpMyFAQ prior to version 4.1.5 are vulnerable when an editor embeds malicious image paths into FAQ content.

With a CVSS score of 5.1 the vulnerability is considered moderate, but the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog, indicating no publicly known widespread attacks. Successful exploitation requires an authenticated user with FAQ editing privileges, and the attacker must embed malicious image paths that are processed during PDF generation. The path concatenation logic can expose any file on the server that is outside the expected content directory, leading to information disclosure but not immediate remote code execution.