CVE-2026-75920

Executive Summary

CVE-2026-75920 affects phpMyFAQ versions prior to 4.1.6, exposing a critical information disclosure vulnerability rooted in insecure temporary file handling (CWE-377). The application writes backup ZIP archives to the web-accessible document root as content.zip, allowing unauthenticated attackers to retrieve sensitive files — including database credentials — if they can race concurrent requests to download the archive before deletion. Additionally, the flaw enables an attacker to chain stored XSS in admin contexts to trigger authenticated backups and exfiltrate the resulting archive. With a CVSS score of 5.3 (High confidentiality impact, no integrity or availability impact), the primary risk is credential exposure leading to downstream compromise of the underlying database infrastructure.

Technical Analysis

The vulnerability resides in phpMyFAQ's backup functionality, specifically in how the application generates and stores content backup ZIP archives. Based on the NVD description, the backup process writes the archive to a predictable, fixed filename — content.zip — within the web-accessible document root. This design flaw combines two distinct weaknesses:

1. Predictable file location and name: The output path is deterministic (content.zip in docroot), meaning any unauthenticated user who knows or guesses the URL can request https://target/content.zip directly.

2. TOCTOU (Time-of-Check to Time-of-Use) race condition: The temporary backup file remains on disk for a window of time between creation and deletion. An attacker can issue repeated, concurrent HTTP GET requests targeting /content.zip during this window, increasing the probability of catching the file before the application deletes it.

The CWE-377 classification (Insecure Temporary File) indicates the application creates temporary files with insufficiently random names or in a location where another user/process can access them. In this case, the temporary file is placed in the web root rather than a protected directory outside the web server's document tree, making it directly retrievable via HTTP.

The NVD description also indicates an XSS component: "attackers can … exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive." This suggests a secondary attack path where the attacker compromises an admin session (via stored or reflected XSS) and programmatically invokes the backup functionality within the authenticated context. The resulting content.zip would then be accessible to the attacker, who can retrieve it via the same predictable URL.

The archive contains "sensitive files including database credentials" — likely the application's configuration file with database connection details (hostname, username, password), and potentially uploaded attachments, user data, or cached content.

The attack requires high complexity (AC:H) per the CVSS vector: the race condition window is small, and the XSS path requires user interaction (UI:R — victim admin must be tricked into loading malicious content). However, no privileges are required (PR:N) — the primary race-based retrieval path is fully unauthenticated.

Technical detail insufficiency

The NVD description does not specify the exact deletion mechanism, the directory path beyond "document root," the backup creation trigger, or the precise XSS injection point. Specific function names, class names, and parameter details are not available from the provided data. The analysis above is based strictly on the vulnerability class mechanics (predictable temporary file location + race condition + archive content exposure).

Exploitation Scenarios

Scenario 1: Unauthenticated Race Condition (Primary Vector)

Step 1 — Reconnaissance: The attacker identifies a phpMyFAQ instance via search engine dorking (e.g., inurl:index.php?action=faq), fingerprinting via http.title:"phpMyFAQ", or observing the Powered by phpMyFAQ footer. Version disclosure in page source or response headers confirms whether the target is vulnerable (< 4.1.6).

Step 2 — Trigger backup: The attacker must induce the application to generate a backup archive. The NVD description indicates backups can be triggered in admin contexts, but the unauthenticated path is not fully specified. The attacker may exploit an unauthenticated endpoint that initiates a backup (if such exists), or wait for a legitimate admin to schedule/perform a backup operation.

Step 3 — Race concurrent requests: Upon detecting that a backup operation has started (e.g., by monitoring for directory listing changes or via timing side-channels), the attacker fires a high-volume of concurrent HTTP GET requests to https://target/content.zip. The objective is to land a request within the window between file creation and file deletion.

Step 4 — Post-exploitation: Upon successful retrieval, the attacker extracts the ZIP archive, locating the configuration file containing database credentials. These credentials are then used to connect directly to the database server, exfiltrate data, attempt credential reuse on other services, or pivot into the internal network.

Scenario 2: XSS-to-Backup Chain (Authenticated Context)

Step 1 — Reconnaissance: The attacker identifies an admin user and discovers an XSS injection point in the application (the NVD description confirms XSS exists in admin contexts, though the exact injection vector is not specified — e.g., unsanitized user input rendered in admin pages).

Step 2 — Deliver XSS payload: The attacker crafts a malicious payload (e.g., a JavaScript snippet embedded in a user profile field, FAQ content, or comment section). The payload, when rendered in an admin's browser, issues a request to trigger the backup functionality — potentially by invoking the same backup endpoint/form used in manual admin backups.

Step 3 — Retrieve archive: The XSS payload can either directly exfiltrate the backup by making the admin's browser navigate to /content.zip and forward the data, or it can first trigger the backup and then instruct the attacker that the file is ready.

Step 4 — Post-exploitation: The attacker retrieves the archive via the predictable URL, extracts credentials, and follows the same post-exploitation path as Scenario 1.

Prerequisites & Limitations

• The race window for Scenario 1 may be extremely short (milliseconds to seconds), requiring multiple concurrent connection attempts.
• No public PoC is available; attack chains are inferred from vulnerability class and the NVD description.
• The XSS path requires social engineering (admin interaction), reflected in the CVSS UI:R component.

Impact Assessment

CVSS Base Score: 5.3 (Medium) — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Business Impact:

• Credential exposure: The database credentials embedded in the backup archive are the crown jewels. An attacker with these can access the entire FAQ database, potentially containing user PII, private Q&A content, internal knowledge base entries, and admin hashes.
• Lateral movement: Database credentials may be reused across other internal services (SSH, email, other web applications) if administrators practice credential reuse.
• Compliance/regulatory: Exposure of user PII protected under GDPR, CCPA, or HIPAA (if medical data resides in FAQs) constitutes a reportable data breach.
• Reputational: phpMyFAQ is widely used by enterprises for internal knowledge bases; a compromise undermines trust in both the application and the hosting organization.

Blast Radius:

• Directly affected: phpMyFAQ instances < v4.1.6 exposed to the internet.
• Indirectly affected: Database servers configured for the phpMyFAQ application; internal networks reachable from those database servers.
• The archive contains "sensitive files" beyond credentials — uploaded attachments may contain confidential documents.

Affected Systems: All phpMyFAQ deployments running versions prior to 4.1.6 where the web server serves the document root directory where backups are written. Any deployment where the web server does not prevent direct access to content.zip is at risk.

Detection Guidance

Sigma Rule

title: phpMyFAQ Backup Archive Access Attempt (CVE-2026-75920)
id: 8f6a4b2c-3d5e-4f7a-9b1c-2d4e6f8a0b1c
status: experimental
description: Detects attempts to access the predictable phpMyFAQ backup archive content.zip, which may indicate exploitation of CVE-2026-75920
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
  category: webserver
  product: apache
  definition: 'Web server access logs'
detection:
  selection:
    cs-uri-query|contains|all:
      - 'content.zip'
  condition: selection
falsepositives:
  - Legitimate admin downloads of backup archives (rare; backups should be stored outside webroot)
  - Search engine crawlers indexing previously exposed files
level: high
fields:
  - c-ip
  - cs-method
  - cs-uri-query
  - sc-status
tags:
  - attack.t1190
  - attack.t1005
  - cve.2026-75920
  - cwe.377

YARA Rule

rule PhpMyFAQ_Backup_Archive_Exposure {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects phpMyFAQ backup ZIP archive data containing database configuration strings"
        date = "2026-01-15"
        reference = "CVE-2026-75920"
        cve = "CVE-2026-75920"
        cwe = "CWE-377"
        severity = "high"
    strings:
        $db_string1 = "phpmyfaq" ascii wide nocase
        $db_string2 = "db_password" ascii wide nocase
        $db_string3 = "mysqli" ascii wide nocase
        $zip_magic = { 50 4B 03 04 }  // PK\x03\x04 ZIP local file header
        $config_name = "config.php" ascii wide nocase
        $backup_name = "content.zip" ascii wide nocase
    condition:
        uint32(0) == 0x04034B50 and
        (any of ($db_string*) or $zip_magic) and
        ($config_name or $backup_name)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT phpMyFAQ content.zip Backup Archive Access Attempt (CVE-2026-75920)";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/content.zip"; http_uri;
    classtype:attempted-recon;
    sid:2026075920;
    rev:1;
    reference:cve,2026-75920;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-75920;
    metadata:created_at 2026_01_15;
    metadata:attack_target Web_Server;
    metadata:deployment Perimeter;
    metadata:signature_severity Major;
    metadata:former_category WEB_SERVER;
)

alert http any any -> any any (
    msg:"ET EXPLOIT phpMyFAQ Concurrent Backup Request Storm (CVE-2026-75920)";
    flow:to_server,established;
    content:"/content.zip"; http_uri;
    threshold:type both, track by_src_ip, count 20, seconds 5;
    classtype:attempted-recon;
    sid:2026075921;
    rev:1;
    reference:cve,2026-75920;
    metadata:created_at 2026_01_15;
)

Elastic Detection

// Detect rapid successive requests to the backup archive file
sequence by source.ip with maxspan=10s
  [network where http.request.method == "GET" and http.request.uri contains "content.zip"]
  [network where http.request.method == "GET" and http.request.uri contains "content.zip"]
  [network where http.request.method == "GET" and http.request.uri contains "content.zip"]

// Detect successful retrieval of the backup archive with large response body
any where event.dataset == "nginx.access" or event.dataset == "apache.access"
  and url.path == "/content.zip"
  and http.response.status_code == 200
  and http.response.body.bytes > 50000

Splunk SPL Query

index=weblogs sourcetype=access_combined
| where like(uri_path, "%content.zip%")
| stats count, values(uri_path) as paths, values(status) as codes, dc(clientip) as src_ip_count
    BY clientip, uri_path, _time
| where count > 20
| table _time, clientip, count, paths, codes
| sort - count
| rename clientip as "Source IP", count as "Request Count", paths as "Requested Paths"

index=weblogs sourcetype=access_combined
| search "content.zip" AND status=200
| eval response_size_mb = round(bytes/1048576, 2)
| where response_size_mb > 0.05
| table _time, clientip, uri_path, bytes, response_size_mb, referer, useragent
| sort - response_size_mb

Wazuh OSSEC Rule

<group name="phpmyfaq,">
  <rule id="100270" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>content\.zip</match>
    <description>phpMyFAQ backup archive (content.zip) accessed - potential CVE-2026-75920 exploitation</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  
  <rule id="100271" level="14" frequency="20" timeframe="60">
    <if_matched_sid>100270</if_matched_sid>
    <same_source_ip/>
    <description>Rapid repeated requests to phpMyFAQ content.zip - race condition exploitation pattern (CVE-2026-75920)</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor has released phpMyFAQ v4.1.6, which the NVD description identifies as the first fixed version, but no official security advisory or patch CVE reference is currently tracked.

Immediate Mitigations (implement today)

1. Block direct web access to the backup file: Add web server rules to deny all requests for /content.zip:

   • Apache: <Files "content.zip"> Require all denied </Files>
   • Nginx: location ~ ^/content\.zip$ { deny all; }
   • IIS: Request Filtering rule blocking content.zip extension/path.

2. Move backup storage location: If phpMyFAQ allows configuration of backup path, relocate it outside the web-accessible document root to a protected directory (e.g., /var/lib/phpmyfaq/backups).

3. Restrict file permissions: Ensure the backup file is written with restrictive permissions (0600 or at minimum 0644 with no world-read for directories).

4. Monitor for content.zip requests: Enable the detection rules above in SIEM/IDS to alert on any access attempts.

5. Rotate database credentials: Assume that if the file has been exposed historically, credentials may already be compromised. Rotate the database password used by phpMyFAQ.

Patch/Upgrade Steps

1. Upgrade to phpMyFAQ v4.1.6 or later immediately. The NVD description confirms this version addresses the vulnerability.
2. After upgrade, verify that backup files are no longer written to the document root, and that the filename is no longer predictable.
3. Test the backup functionality to ensure archives are placed in non-web-accessible storage.

Long-Term Hardening

1. Enforce least-privilege database accounts: The phpMyFAQ database user should have only the minimal privileges required (SELECT/INSERT/UPDATE/DELETE on the phpMyFAQ schema) — never administrative privileges.
2. Network segmentation: Isolate the database server on a separate network segment, accessible only from application servers.
3. Web application firewall: Deploy a WAF rule to block access to predictable filenames and sensitive file types (.zip, .sql, .bak, .tar.gz).
4. Regular vulnerability scanning: Include phpMyFAQ in regular automated scanning cycles.
5. Secure backup practices: All application-generated backups should be written to a dedicated backup server or object storage bucket with strict access controls, never to the web root.
6. Disable backup functionality in production: If backup operation is rarely used manually, disable the feature or make it accessible only from internal admin IP ranges.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-75920 (Official CVE record containing the description used in this report)
2. phpMyFAQ Official Site — https://www.phpmyfaq.de (Vendor site; release notes for v4.1.6 contain the fix)
3. CWE-377: Insecure Temporary File — https://cwe.mitre.org/data/definitions/377.html (Weakness class reference)
4. phpMyFAQ GitHub Repository — https://github.com/thorsten/phpMyFAQ (Source code repository; vulnerability fix commit history)
5. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

Known threat actor campaigns / exploit-in-the-wild evidence: None documented at the time of writing. CVE-2026-75920 is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public PoC, Nuclei template, or Metasploit module has been identified. However, given the low complexity of the race-condition retrieval mechanism and the predictability of the target file path, opportunistic exploitation is likely once the vulnerability becomes widely known. Security teams should assume active scanning for content.zip on internet-facing phpMyFAQ instances.

Report generated by Valtersit Threat Intelligence — 2026-01-15. Classification: TLP:CLEAR. This report is based solely on the provided NVD description and associated CVE data; where technical details were insufficient, attack mechanisms are described at the vulnerability-class level without fabricated specifics.