CVE-2026-75920

phpMyFAQ versions before 4.1.6 write content backup ZIP archives into the web-accessible document root as content.zip, an insecure temporary file flaw (CWE-377) that can expose sensitive files, including database credentials. An unauthenticated attacker can race the backup process with concurrent requests to download the ZIP before the application deletes it, or chain XSS in admin contexts to trigger an authenticated backup and then retrieve the archive. Successful exploitation primarily discloses confidential data—most notably database credentials—giving attackers a path into the underlying database (CVSS 4.0: 6.0 Medium, high confidentiality impact, but high attack complexity and some user interaction required). Any deployment running phpMyFAQ prior to 4.1.6 is affected, especially internet-facing instances whose document root is directly reachable. No in-the-wild exploitation has been reported (EPSS 0.3%, not in CISA KEV), but a public vendor advisory with a PoC reference is available.

What to do: Upgrade to phpMyFAQ 4.1.6 or later. As an interim mitigation, block web access to /content.zip (e.g., a web-server deny rule) and confirm backups are not being written into the document root; also review access logs for requests to content.zip that could indicate prior credential exposure. Patch any admin-context XSS as well, since it can be chained to trigger backups and download the archive.