phpMyFAQ prior to version 4.1.6 writes backup ZIP archives to the web‑accessible document root as content.zip. The archive can contain sensitive files, including database credentials, which disclose confidential data to users that can download the file. The weakness is classified as CWE‑377, reflecting improper handling of temporary files. Unauthenticated users can race concurrent requests to download the temporary ZIP before the application removes it, or, if they can inject malicious code through XSS in the admin interface, they can trigger a backup and retrieve the archive. Based on the description, it is inferred that the attacker must be able to retrieve the file through a web request or to exploit an existing XSS vulnerability in the admin interface.

The vulnerability affects all installations of phpMyFAQ built by thorsten that are running any release earlier than 4.1.6. Users relying on the automatic backup feature in these older versions are at risk.

The CVSS score of 6.0 indicates medium severity. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented exploits as of the time of this analysis. The likely attack vector is a web-based request that accesses the exposed backup file, or an XSS exploit to trigger the backup from an authenticated administrator session. Given the medium CVSS and the potential for sensitive data exposure, the overall risk is significant for organizations still running unpatched versions.