Server-Side Request Forgery in phpMyFAQ PDF Export Feature
CVE-2026-116182

5.3MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116182?

phpMyFAQ versions prior to 4.1.10 are vulnerable to a server-side request forgery through the PDF export feature. This vulnerability allows attackers to manipulate FAQ content and embed malicious image URLs that direct the server to make unauthorized requests to internal or loopback services. As a result, sensitive information could be exposed in generated PDFs, posing significant security risks for organizations relying on phpMyFAQ for FAQ management.

Affected Version(s)

phpMyFAQ 0 < 4.1.10

phpMyFAQ 4.1.10

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-before-4.1....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hariprasanth9317-tech
.