https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:59:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-264533 EUVD-2026-264533 https://cve.radiocsirt.org/vuln/euvd-2026-264533 https://cve.radiocsirt.org/vuln/fkie_cve-2025-69200 <p>phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.</p> <p>phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-69200 https://cve.radiocsirt.org/vuln/ghsa-9cg9-4h4f-j6fg <p><strong>Affected:</strong> Packagist: thorsten/phpmyfaq</p> <p>### Summary An unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise.</p> <p>### Details The endpoint `/api/setup/backup` is reachable via default rewrite rules and does not enforce authentication/authorization or API token verification. When called with any non-empty body (used as an “installed version” string), the server creates a ZIP archive inside the configuration directory and returns a direct URL to the generated ZIP file.</p> <p>Relevant code paths: - Rewrite rule exposing the endpoint: - `phpmyfaq/.htaccess`: `RewriteRule ^api/setup/(check|backup|update-database) api/index.php [L,QSA]` - Controller implementation: - `phpmyfaq/src/phpMyFAQ/Controller/Api/SetupController.php` → `backup()` - No call to `hasValidToken()`, `userIsAuthenticated()`, or any permission check - Backup creation: - `phpmyfaq/src/phpMyFAQ/Setup/Update.php` → `createConfigBackup()` - Writes the ZIP into the config directory and returns a public URL under `content/core/config/`</p> <p>### PoC Replace `BASE_URL` with your instance URL.</p> <p>1) Trigger config backup generation without authentication:</p> <p>```bash BASE_URL=&#34;http://localhost&#34; curl -i -X POST &#34;${BASE_URL}/api/setup/backup&#34; \ -H &#34;Content-Type: t…</p> <p><strong>Affected:</strong> Packagist: thorsten/phpmyfaq</p> <p>### Summary An unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise.</p> <p>### Details The endpoint `/api/setup/backup` is reachable via default rewrite rules and does not enforce authentication/authorization or API token verification. When called with any non-empty body (used as an “installed version” string), the server creates a ZIP archive inside the configuration directory and returns a direct URL to the generated ZIP file.</p> <p>Relevant code paths: - Rewrite rule exposing the endpoint: - `phpmyfaq/.htaccess`: `RewriteRule ^api/setup/(check|backup|update-database) api/index.php [L,QSA]` - Controller implementation: - `phpmyfaq/src/phpMyFAQ/Controller/Api/SetupController.php` → `backup()` - No call to `hasValidToken()`, `userIsAuthenticated()`, or any permission check - Backup creation: - `phpmyfaq/src/phpMyFAQ/Setup/Update.php` → `createConfigBackup()` - Writes the ZIP into the config directory and returns a public URL under `content/core/config/`</p> <p>### PoC Replace `BASE_URL` with your instance URL.</p> <p>1) Trigger config backup generation without authentication:</p> <p>```bash BASE_URL=&#34;http://localhost&#34; curl -i -X POST &#34;${BASE_URL}/api/setup/backup&#34; \ -H &#34;Content-Type: t…</p> https://cve.radiocsirt.org/vuln/ghsa-9cg9-4h4f-j6fg