CVE-2026-116182

medium

Description

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them and embed responses in generated PDFs.

References

https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.10-ssrf-via-pdf-export-image-fetching

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8wmv-9c4g-p5mg

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109443

Details

Source: Mitre, NVD

Published: 2026-10-25

Updated: 2026-10-25

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Severity: Medium