Security readout for executives and security teams
Plain-English summary
phpMyFAQ versions before 4.1.6 allow a highly privileged administrator to turn an application update mechanism into remote code execution. Successful abuse could compromise the FAQ service, its data, and connected systems accessible to the web server account. The flaw is critical, but exploitation requires authentication and two specific privileges.
Executive priority
Treat this as an urgent remediation item for every pre-4.1.6 deployment, especially internet-facing or business-critical instances. Prioritize upgrading and reviewing privileged accounts. The lack of reported active exploitation lowers immediate threat evidence, but the potential impact of web-server-level code execution remains severe.
Technical view
The configuration API insufficiently protects the updater’s package source. An authenticated administrator holding CONFIGURATION_EDIT and ATTACHMENT_ADD can cause an attacker-controlled archive to place PHP files in the application root, resulting in code execution as the web server user. The issue is classified as CWE-494 and scored 9.4 under CVSS 4.0.
Likely exposure
Exposure is limited to phpMyFAQ installations earlier than 4.1.6 where an attacker controls, compromises, or abuses an account with both required privileges. Internet-facing deployments and environments granting these permissions broadly warrant urgent review. The supplied evidence does not establish exposure for version 4.1.6 or later.
Exploitation context
The supplied sources do not report active exploitation, and this CVE is not identified as KEV. Exploitation nevertheless has low stated complexity after obtaining a sufficiently privileged account and requires no user interaction. Authentication and the combined CONFIGURATION_EDIT and ATTACHMENT_ADD permissions are important constraints.
Researcher notes
The privilege requirement distinguishes this from unauthenticated RCE, but compromised administrator credentials or excessive role assignments could satisfy it. Validation should correlate attachment activity, configuration changes, and new PHP files. The supplied evidence does not describe proof-of-concept availability, observed attacks, persistence behavior, or indicators of compromise.
Mitigation direction
- Upgrade phpMyFAQ to version 4.1.6 or later after reviewing vendor guidance.
- Restrict CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to essential, trusted administrators.
- Disable or limit administrative access from untrusted networks where operationally feasible.
- Rotate credentials and investigate if a qualifying administrator account may be compromised.
Validation and detection
- Inventory phpMyFAQ deployments and confirm each installed version.
- Identify accounts and roles holding both required administrative privileges.
- Review administrative activity for unusual attachment uploads or updater configuration changes.
- Inspect the application root for unexpected or recently created PHP files.
- Confirm the upgraded deployment reports version 4.1.6 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-494: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-66398 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.4CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-4fv7-8rr6-rf2w)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: phpMyFAQ before 4.1.6 Remote Code Execution via Configuration APICVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Download of Code Without Integrity Check
Download of Code Without Integrity Check represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.