CVE-2026-75920

Katalog CVE

CVSS 5.3 · Medium EPSS 0,36%

Kerentanan Insecure Temporary File pada phpmyfaq. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-377: Insecure Temporary File

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8hmh-mrx6-pqvf exploit · advisory vendor
• https://www.vulncheck.com/advisories/phpmyfaq-before-information-disclosure-via-backup-zip advisory pihak ketiga