CVE-2026-76210

phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before converting them to PDF with the TCPDF library, allowing a controlled file path (CWE-73) to reach the PDF generation routine. An attacker with permission to create or edit FAQ content can embed an <img> tag whose src points to a local file under the web root's content/ directory (e.g., content/core/config/database.php); when a PDF export runs, phpMyFAQ reads the referenced file and, because it is not a valid image, an uncaught exception leaks part of the file's contents via its stack trace to whoever triggers the export. The attacker gains disclosure of sensitive local file contents: the leaked portion is truncated by default (zend.exception_string_param_max_len), but a larger configured value can expose entire files, including database credentials. Any phpMyFAQ deployment running a version prior to 4.1.6 is affected; exploitation requires only a low-privileged account with FAQ authoring rights and no victim interaction (CVSS 4.0: 7.1 High). No in-the-wild exploitation is known: a public advisory/PoC exists (GHSA-c63q-xx7x-j8w2), EPSS is 0.4% (percentile 30), and the issue is not in CISA KEV.

What to do: Upgrade to phpMyFAQ 4.1.6 or later. Until patched, restrict FAQ create/edit rights to trusted users and review existing FAQ answers for <img> tags whose src references local paths under the content/ directory (e.g., content/core/config/database.php). Keep exception detail display and zend.exception_string_param_max_len at their defaults so any leaked content remains truncated, and avoid exposing verbose stack traces to end users.