CVE-2026-75918

Executive Summary

CVE-2026-75918 is a high-severity information disclosure and account-takeover vulnerability affecting phpMyFAQ versions prior to 4.1.7. The flaw allows unauthenticated remote attackers to read a publicly accessible tracking file (content/core/data/trackingDDMMYYYY) that contains password reset tokens when user tracking functionality is enabled. By extracting these tokens and replaying them against the password reset API, an attacker can take over arbitrary user accounts — including administrative accounts — without any prior authentication or interaction beyond a single user action in the attack chain. The vulnerability carries a CVSS score of 8.8, indicating critical impact on confidentiality, integrity, and availability. At the time of writing, no patch has been released or confirmed, no public exploit code exists, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Technical Analysis

Vulnerability Class and Mechanism

CVE-2026-75918 is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerability. The root cause lies in phpMyFAQ's user tracking subsystem, which — when enabled by an administrator — writes password reset tokens into a persistent tracking file on disk. This file is stored within the web-accessible directory tree at the path content/core/data/trackingDDMMYYYY, where DDMMYYYY corresponds to the current date in day-month-year format.

The critical flaw is twofold:

1. Inadequate Access Control on Tracking File: The tracking file is served by the web server without any authentication or authorization checks. Because it resides under the content/core/data/ directory (a path that is part of the publicly accessible web root), any unauthenticated user can request it directly via a simple HTTP GET request. The file is not protected by .htaccess rules, randomized filenames, or server-side access control lists.

2. Sensitive Data in Tracking Log: When a password reset is requested, phpMyFAQ generates a one-time reset token and stores it in the user tracking record — ostensibly for audit purposes. This token is written into the tracking file in plaintext. Because the tracking file is world-readable, the token leaks to any party who can fetch the file.

Affected Component and Attack Surface

• Component: phpMyFAQ user tracking module (enabled via configuration; not default-off in all deployments).
• Attack Surface: The web server's public-facing HTTP(S) interface. No authentication is required to trigger the information disclosure.
• Prerequisite: User tracking must be enabled in the phpMyFAQ configuration. Deployments with tracking disabled are not directly affected by this specific attack vector, though enabling tracking is a common operational practice for administrators to monitor user behavior.

Reset Token Lifecycle

The password reset flow in phpMyFAQ works as follows (based on the vulnerability description):

• A user (or attacker) initiates a password reset for a target account.
• phpMyFAQ generates a unique, time-limited reset token.
• The token is sent to the target user's email (normal behavior) and logged into the tracking file.
• The attacker, having previously read the tracking file, obtains the token before the legitimate user uses it (or in parallel).
• The attacker replays the token against the password reset API endpoint, setting a new password of the attacker's choosing.

This attack requires no user interaction for the initial reconnaissance (reading the tracking file), but the CVSS vector includes UI:R (User Interaction Required) — likely because a user must have previously triggered a password reset for a token to exist in the file, or because the attack requires one legitimate user action to set up the token. In practice, an attacker can self-trigger by initiating a reset on a target account, then immediately reading the tracking file.

Code-Level Explanation (Inferred from Description)

The NVD description does not include function names, class names, or API endpoint paths. Per accuracy rules, we do not fabricate these. However, the mechanism is clear: the tracking file write operation fails to sanitize or exclude password-reset tokens from the log output, and the file-read operation fails to enforce authentication. These are distinct failures in the tracking subsystem and the web server configuration, respectively.

Exploitation Scenarios

1. Reconnaissance / Target Identification

An attacker first identifies phpMyFAQ installations via internet-wide scanning using Shodan or similar search engines with queries such as http.title:"phpMyFAQ" or http.html:"Powered by phpMyFAQ". The attacker then verifies that user tracking is enabled by attempting to read the tracking file for the current date. A successful HTTP 200 response with content confirms the vulnerability is present.

2. Flaw Trigger (Information Disclosure)

The attacker requests the tracking file directly:

GET /content/core/data/tracking{current_date}.php

(Exact file extension unknown from description; the path content/core/data/trackingDDMMYYYY is given as-is.) The server returns the file contents without authentication.

3. Token Extraction and Replay

From the file contents, the attacker identifies password reset tokens for target user accounts. If no tokens exist (because no resets have been requested recently), the attacker initiates a password reset for a high-privilege account (e.g., administrator) via the standard reset request form. When the reset is processed, the token is written to the tracking file, which the attacker then re-reads within the token's validity window.

4. Post-Exploitation

The attacker replays the extracted token against the password reset API (e.g., a password reset confirmation endpoint). After setting a new password, the attacker logs in as the target user. If the target is an administrative account, the attacker gains full administrative control of the phpMyFAQ application — including the ability to read/modify all FAQ content, access user databases, upload files if the CMS supports it, and potentially pivot to the underlying server through file upload or PHP execution features.

No public PoC is available at this time; the attack chain is inferred from the vulnerability class and the explicit file-path and token-exposure details in the NVD description.

Impact Assessment

Business Impact: High. phpMyFAQ is a widely deployed open-source FAQ management system used by enterprises, government agencies, and educational institutions to publish internal and external knowledge bases. A successful account takeover of an administrative account compromises the integrity of all published content — an attacker could inject malicious links, deface the FAQ, or distribute malware via trusted FAQ pages. Data confidentiality is breached because password reset tokens for all users who have recently reset passwords may be exposed.

Affected Systems: All phpMyFAQ installations running versions prior to 4.1.7 where the user tracking feature is enabled. The vulnerability affects the web application layer; the underlying database is not directly impacted, but lateral movement is possible if the FAQ application has server-side file write capabilities.

Blast Radius: The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a base score of 8.8 (High). Breakdown:

• Confidentiality Impact: High — reset tokens (and by extension, account credentials) are exposed.
• Integrity Impact: High — arbitrary password changes and content modifications possible.
• Availability Impact: High — administrative takeover can lead to denial of service via content deletion or account lockouts.
• Privileges Required: None — unauthenticated access suffices.
• User Interaction: Required — a single password reset must be triggered; attacker can trigger it themselves, making the practical interaction requirement trivial.

Exploitability in the Wild: Unknown. No public exploit code or PoC has been identified as of the report date. EPSS has not yet scored this vulnerability. CISA KEV does not list this CVE.

Detection Guidance

Sigma Rule

Detects attempts to read the phpMyFAQ tracking file via HTTP.

title: phpMyFAQ Tracking File Access - Password Reset Token Exfiltration
id: 3f8b1a2e-7d4c-4f5e-9a2c-6d1b3e9f0a5e
status: experimental
description: Detects HTTP requests to the phpMyFAQ tracking file path, which may indicate token exfiltration (CVE-2026-75918)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75918
author: Valtersit Threat Intelligence
date: 2026/04/10
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for phpMyFAQ deployments'
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/content/core/data/tracking'
    condition: selection
level: high
falsepositives:
    - Legitimate administrative access to debug tracking files (rare)
fields:
    - c-ip
    - cs-uri-stem
    - sc-status

YARA Rule

Detects the tracking file pattern in filesystem scans or exfiltrated data.

rule phpMyFAQ_Tracking_File_ResetToken
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects phpMyFAQ tracking files containing password reset token patterns"
        cve = "CVE-2026-75918"
        date = "2026-04-10"
    strings:
        $token_pattern = /[a-f0-9]{32,64}/  // hex token (format inferred; adjust as needed)
        $tracking_header = "tracking" ascii
        $date_pattern = /[0-9]{8}/  // DDMMYYYY in filename
        $user_ref = "user" ascii nocase
    condition:
        $tracking_header and $token_pattern and #date_pattern >= 1 and filesize < 10MB
}

Note: The exact token format is not specified in the NVD description. The YARA rule uses a generic hex pattern; adjust the regex to match the actual token format if known from vendor documentation.

Suricata IDS Rule

Detects HTTP requests to the tracking file path.

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT phpMyFAQ Tracking File Access Attempt (CVE-2026-75918)";
    flow:established,to_server;
    http.method; content:"GET";
    http.uri; content:"/content/core/data/tracking";
    http.uri; content:".php";  // adjust if extension is different or absent
    classtype:attempted-recon;
    sid:7581801;
    rev:1;
    metadata:created_at 2026-04-10, cve CVE-2026-75918;
)

Elastic Detection

EQL query for web access logs.

any where
  event.category == "web" and
  network.protocol == "http" and
  http.request.method == "GET" and
  url.path like "/content/core/data/tracking*"

Splunk SPL Query

Search for access to the tracking file path.

index=web sourcetype=access_combined
| eval uri_path = replace(uri_path, "\\?.*$", "")
| where uri_path LIKE "/content/core/data/tracking%"
| table _time, src_ip, user, uri_path, http_status
| stats count by src_ip, uri_path

Wazuh OSSEC Rule

XML rule to trigger alerts on tracking file access.

<rule id="901543" level="12">
    <decoded>apache-accesslog</decoded>
    <description>phpMyFAQ tracking file accessed - potential password reset token exfiltration (CVE-2026-75918)</description>
    <group>cve-2026-75918,attack.recon,</group>
    <match>GET /content/core/data/tracking</match>
    <regex>(\S+ \S+)</regex>
    <alert>
        <level>12</level>
    </alert>
    <info>Unauthenticated access to phpMyFAQ tracking file detected from IP %srcip</info>
</rule>

Note: OSSEC rule syntax may vary by Wazuh version; adjust regex and match patterns to fit your log format.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, commit, or release that fixes this issue has been identified from any tracked source as of the report date. The vendor has not published a patched version beyond 4.1.7, and there is no evidence that the 4.1.7 release itself addresses this vulnerability. Do not assume 4.1.7 is safe.

Immediate Mitigations (while awaiting a true fix):

1. Disable User Tracking: In the phpMyFAQ administration panel, navigate to the configuration and disable the "User Tracking" feature. If tracking is disabled, the tracking file is not written, and no tokens are exposed.
2. Block Web Access to the Tracking Directory: Add a web server rule to deny direct access to the content/core/data/ directory. In Apache:

   <Directory "/path/to/phpmyfaq/content/core/data/">
       Require all denied
   </Directory>
   

   In nginx:

   location ~ ^/content/core/data/ {
       deny all;
   }
   

3. Restrict via .htaccess: Create a .htaccess file in content/core/data/ with Require all denied (Apache) or equivalent.
4. Monitor Access Logs: Actively monitor for requests to the tracking file path and alert on any hits.
5. Rotate Existing Tokens: Force password resets for all administrative accounts immediately, as any tokens generated while tracking was enabled may already be compromised.

Patch/Upgrade Steps: Monitor the phpMyFAQ release channels (GitHub repository, official mailing list, vendor advisory page) for a version higher than 4.1.7 that specifically addresses this CVE. Prior to upgrading, back up the application and database. After upgrade, verify that the tracking file is no longer written with sensitive data.

Long-Term Hardening:

• Principle of Least Privilege: Ensure write-sensitive data (tokens, session IDs, PII) is never logged to web-accessible locations.
• Security Review of Tracking Features: Audit any logging or tracking module for sensitive data leakage before enabling.
• Web Application Firewall (WAF): Deploy WAF rules to block requests matching the tracking file path pattern.
• Regular Vulnerability Scanning: Include phpMyFAQ in periodic vulnerability scans and subscribe to vendor security advisories.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75918
2. phpMyFAQ Official Site (for tracking feature documentation): https://www.phpmyfaq.de/
3. MITRE ATT&CK Technique Reference (T1190): https://attack.mitre.org/techniques/T1190/
4. CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
5. CISA KEV Catalog (checked: NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: No known threat actor campaigns have been publicly attributed to this CVE as of the report date. Public exploit code has not been identified, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. However, given the ease of exploitation (single HTTP GET request) and the high-value target (account takeover of a web application), exploitation in the wild is considered likely once attackers become aware of the flaw. Organizations running affected versions should treat this as an active risk even without public PoC evidence.