phpMyFAQ before version 4.1.6 does not properly sanitize HTML in FAQ answers when it creates PDFs. The application allows an attacker who can create or edit FAQ entries to embed an <img> tag whose src points to a local file inside the web root’s content/ directory. When a PDF is exported, TCPDF attempts to read that file; because it is not a valid image the process throws an exception. The uncaught exception’s stack trace is returned to the client, leaking the content of the referenced file. By default only a truncated portion of the file is shown because of the zend.exception_string_param_max_len setting, but a higher configuration value can expose the entire file, possibly including database credentials.

The vulnerability affects phpMyFAQ releases prior to version 4.1.6. Any system deploying phpMyFAQ with a content/ directory that contains sensitive files and that authorizes users to edit FAQ content and request PDF exports is at risk.

The CVSS score of 7.1 indicates a moderate severity vulnerability, and the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through an authenticated web‑application action that requires permission to edit FAQ entries. Successful exploitation compromises confidentiality of local files. If database credentials are disclosed, an attacker may gain a foothold into backend database systems. Restricting editing rights or disabling PDF export for those accounts reduces the threat surface.