phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.

Affected: Packagist: thorsten/phpmyfaq

### Summary An unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise.

### Details The endpoint `/api/setup/backup` is reachable via default rewrite rules and does not enforce authentication/authorization or API token verification. When called with any non-empty body (used as an “installed version” string), the server creates a ZIP archive inside the configuration directory and returns a direct URL to the generated ZIP file.

Relevant code paths: - Rewrite rule exposing the endpoint: - `phpmyfaq/.htaccess`: `RewriteRule ^api/setup/(check|backup|update-database) api/index.php [L,QSA]` - Controller implementation: - `phpmyfaq/src/phpMyFAQ/Controller/Api/SetupController.php` → `backup()` - No call to `hasValidToken()`, `userIsAuthenticated()`, or any permission check - Backup creation: - `phpmyfaq/src/phpMyFAQ/Setup/Update.php` → `createConfigBackup()` - Writes the ZIP into the config directory and returns a public URL under `content/core/config/`

### PoC Replace `BASE_URL` with your instance URL.

1) Trigger config backup generation without authentication:

```bash BASE_URL="http://localhost" curl -i -X POST "${BASE_URL}/api/setup/backup" \ -H "Content-Type: t…