Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the vulnerability is based on the detailed security advisory GHSA-gh9p-q46p-57g2. The advisory clearly identifies the root cause of the vulnerability in the phpMyFAQ\Instance\Client::deleteClientFolder function. This function fails to sanitize the sourceUrl parameter, allowing for a path traversal attack. The advisory provides a code snippet of the vulnerable function:
public function deleteClientFolder(string $sourceUrl): bool
{
if (!$this->isMultiSiteWriteable()) {
return false;
}
$sourcePath = str_replace(search: 'https://', replace: '', subject: $sourceUrl);
return $this->filesystem->deleteDirectory($this->clientFolder . $sourcePath);
}
The str_replace call is insufficient to prevent directory traversal sequences like ../. An attacker can craft a URL such as https://../../../some/path to cause the application to delete directories outside of the intended scope.
The advisory also identifies the controller and method that acts as the entry point for the attack: phpMyFAQ\Controller\Administration\Api\InstanceController::delete. This method takes the user-provided URL and passes it directly to the vulnerable deleteClientFolder function. The vulnerability allows an administrator with INSTANCE_DELETE permissions to delete arbitrary directories on the server, leading to data loss or denial of service.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| thorsten/phpmyfaq | composer | <= 4.1.1 | 4.1.2 |
| phpmyfaq/phpmyfaq | composer | <= 4.1.1 | 4.1.2 |