A flaw in phpMyFAQ’s configuration API allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD permissions to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. By uploading a malicious ZIP file as an attachment and configuring the updater to point to that file, an attacker can extract code into the application root and execute it as the web server user. The weakness falls under CWE-494: Download of Untrusted Content.

The product affected is Thorsten’s phpMyFAQ, any installation running a version prior to 4.1.6.

The CVSS score of 9.4 indicates critical severity, and the EPSS score of < 1% indicates an extremely low exploitation probability. The vulnerability is not listed in KEV. The attack requires authenticated administrator-level privileges; once those are in play, the attacker can achieve remote code execution with the web server’s privileges. The low EPSS score suggests that exploitation may not yet be widely observed, but the high severity warrants urgent mitigation.