CVE-2026-76210

Executive Summary

CVE-2026-76210 is a local file disclosure vulnerability in phpMyFAQ versions prior to 4.1.6. An authenticated attacker with permission to create or edit FAQ content can craft an HTML <img> tag that references a local file under the web root's content/ directory, such as content/core/config/database.php; when a PDF is generated via TCPDF, the application reads the referenced file and an uncaught exception reveals its contents in a stack trace. The vulnerability carries a CVSS score of 6.5 (High) and affects any phpMyFAQ instance — typically exposed via web portal — where users with FAQ authoring privileges interact with the PDF export functionality.

Technical Analysis

Vulnerability Class

CVE-2026-76210 belongs to CWE-73: External Control of File Name or Path. The flaw lives in the PDF generation pipeline of phpMyFAQ, specifically in the interaction between FAQ answer content and the TCPDF library. The NVD description confirms that phpMyFAQ does not adequately sanitize HTML embedded in FAQ answers before those answers are passed to TCPDF for PDF conversion.

Attack Surface

The attack surface is the authenticated FAQ content authoring system. Any user account with permission to create or edit FAQ content (a low-privilege requirement, as reflected in the CVSS vector PR:L) can submit malicious HTML. The attack vector is network-based (AV:N), requires no user interaction (UI:N), and has no exploitation complexity (AC:L).

Vulnerable Mechanism

The vulnerability relies on the interaction between two components:

1. HTML sanitization gap: phpMyFAQ's input sanitization pipeline does not strip or neutralize <img> tags embedded in FAQ answers. This permits an attacker to embed an <img> tag whose src attribute contains a path to a local file under the web root's content/ directory. The NVD description specifically cites content/core/config/database.php as a viable target.

2. TCPDF file-read behavior: When phpMyFAQ triggers PDF generation, the TCPDF library processes the HTML content and resolves the src attribute of the <img> tag. If the referenced path is not a valid image, the library attempts to read the file regardless. This erroneous read triggers an uncaught exception.

3. Stack trace telemetry leak: The resulting uncaught exception includes a stack trace. The stack trace, in turn, discloses the content of the referenced file — at least partially. By default, the disclosed portion is truncated by PHP's zend.exception_string_param_max_len directive. However, if a server administrator has configured a larger value for that directive, the full contents of the targeted file can be revealed.

Confidentiality Impact

The confidentiality impact is rated High in the CVSS vector (C:H). The file content/core/config/database.php is the most explicitly cited target, and its disclosure would include database credentials — hostname, database name, username, and password — enabling an attacker to connect directly to the underlying database.

Configuration-Dependent Impact

The actual extent of information disclosure depends entirely on the server configuration:

• Default configuration: zend.exception_string_param_max_len truncates the leaked content. An attacker still obtains fragments of the file — potentially including partial credential material.
• Non-default configuration: An administrator who has raised the limit for debugging purposes will expose entire file contents, including full database credential strings.

Exploitation Scenarios

No public PoC or exploit code is currently available. The following attack chain is inferred from the vulnerability class and the NVD description.

Step 1: Reconnaissance / Target Identification

An attacker first identifies a phpMyFAQ instance, typically through HTTP banner analysis, favicon hashes, or search-engine dorks for "Powered by phpMyFAQ" strings. The attacker then enumerates the application to determine the version and to verify the availability of the PDF export feature. Shodan dorks such as http.title:"phpMyFAQ" or http.favicon.hash:-1087340892 can be used to identify exposed instances.

Step 2: Establishing Low-Privilege Access

The attacker authenticates with a low-privileged account that has permission to create or edit FAQ answers. This could be a standard user, moderator, or any custom role with FAQ authoring capability. If self-registration is enabled, access can be trivially obtained. If not, the attacker may need to compromise a legitimate author account via credential stuffing or phishing — but the CVSS vector reflects the authenticated-low-privilege premise.

Step 3: Crafting and Embedding the Malicious Payload

At the vulnerability-class level, the attacker crafts an HTML payload containing an <img> tag whose src attribute points to a local file path under the web root, such as content/core/config/database.php. Because the HTML sanitization pipeline fails to strip or neutralize this tag, the payload is stored as part of the FAQ answer content.

The payload mechanism is straightforward HTML injection — no special encoding, obfuscation, or file-upload primitive is required beyond the authoring capability. The attacker saves the FAQ entry, making the malicious content persistent in the application's data store.

Step 4: Triggering PDF Generation

The attacker (or any unauthenticated user — note UI:N in the CVSS vector) triggers the PDF export functionality for the crafted FAQ entry. phpMyFAQ invokes TCPDF to render the FAQ answer into PDF, and TCPDF processes the embedded <img> tag.

Step 5: Exploitation and Exfiltration

TCPDF attempts to read the file referenced by the src attribute. Since the target is not a valid image, the read operation fails and raises an uncaught exception. The exception's stack trace — returned to the requesting user's HTTP response — contains the file contents. The attacker retrieves the response and extracts credentials or other sensitive data.

If the server is configured with the default zend.exception_string_param_max_len cap, the attacker receives only a truncated portion of the file. Given that database.php typically contains credentials near the top of the file structure, even a truncated dump may expose the credential lines. If the server runs with a raised limit, the attacker receives the full file.

Post-Exploitation

With database credentials in hand, the attacker can:

• Directly connect to the underlying MySQL/MariaDB database.
• Extract all FAQ content, user accounts, password hashes, and application settings.
• Escalate privileges by modifying user roles or inserting a backdoor administrator account.
• Pivot to other infrastructure if the database server resides on an internal network.

Impact Assessment

Business Impact

phpMyFAQ is a widely deployed self-hosted FAQ/knowledge-base platform, commonly used by enterprises to provide product documentation and support content to customers and internal staff. A successful exploitation of this vulnerability compromises the confidentiality of the application's underlying configuration — most critically, database credentials.

Technical Impact

• Confidentiality: HIGH — Disclosure of database credentials and potentially arbitrary files under the content/ directory.
• Integrity: NONE — The attack does not modify data (CVSS I:N).
• Availability: NONE — The attack does not affect service availability (CVSS A:N).

Blast Radius

• Directly affected: All phpMyFAQ instances running versions prior to 4.1.6 with PDF export enabled and with FAQ authoring roles present.
• Downstream risk: Once database credentials are exposed, the blast radius expands to the entire database schema, all application data, and potentially the hosting infrastructure.
• Configuration dependence: Instances with a custom zend.exception_string_param_max_len value face exponentially greater confidentiality risk (full-file exfiltration).

CVSS Breakdown (computed from the supplied vector)

• Attack Vector: Network (AV:N) — exploitable over the network.
• Attack Complexity: Low (AC:L) — no special conditions required.
• Privileges Required: Low (PR:L) — requires an authenticated FAQ author role.
• User Interaction: None (UI:N) — no victim interaction required.
• Scope: Unchanged (S:U) — the vulnerability does not cross trust boundaries.
• Confidentiality: High (C:H) — full credential disclosure possible.
• Integrity: None (I:N).
• Availability: None (A:N).

Overall CVSS score: 6.5 (High)

EPSS Context

With an EPSS score of 0.00286 (20.6% percentile), this vulnerability is not currently being actively exploited at scale. However, the existence of public PoC content (classified as "Public") lowers the barrier to exploitation and suggests that weaponization is feasible.

Detection Guidance

Sigma Rule

title: phpMyFAQ PDF Export Local File Disclosure Attempt
id: 46a7c3f2-9d1e-4b6a-8f2c-3a5b7d9e1c42
status: experimental
description: >
  Detects attempts to exploit CVE-2026-76210 by injecting img tags referencing
  local files (e.g., content/core/config/database.php) into FAQ answers prior
  to PDF generation via TCPDF.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76210
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
  category: web_application
  product: phpmyfaq
detection:
  selection_pdf_generation:
    cs-method: GET
    cs-uri-query|contains:
      - "export"
      - "pdf"
      - "generate"
  selection_file_reference:
    cs-uri-query|contains:
      - "content/core/config/"
      - "content/"
  selection_src_param:
    cs-uri-query|contains:
      - "img"
      - "src="
  selection_exception:
    cs-body|contains:
      - "Uncaught"
      - "Stack trace"
      - "TCPDF"
  condition: selection_pdf_generation and (selection_file_reference or selection_src_param) or selection_exception
  timeframe: 5m
level: high
falsepositives:
  - Admin users legitimately generating PDFs containing static images from content directory
  - Debug stack traces visible to admin users on misconfigured servers
tags:
  - attack.t1190
  - cve.2026.76210
  - cwe.73

YARA Rule

rule phpmyfaq_cve_2026_76210_exploit_payload {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects payloads targeting CVE-2026-76210 — img tag src pointing to local files under content/ directory"
        cve = "CVE-2026-76210"
        cwe = "CWE-73"
        date = "2026-01-15"
        score = 80
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76210"
    strings:
        $img_tag = "<img" nocase
        $src_attr = "src=" nocase
        $content_dir = "content/core/config/database.php" ascii nocase
        $content_dir_alt = "content/core/config/" ascii nocase
        $php_ext = ".php" ascii nocase
        $local_path = "file://" ascii nocase
        $tcpdf_ref = "TCPDF" ascii nocase
        $stacktrace = "Stack trace" ascii nocase
        $uncaught = "Uncaught" ascii nocase
    condition:
        uint16(0) == 0x3c21 or
        ($img_tag and $src_attr and $php_ext and $content_dir) or
        ($img_tag and $src_attr and $local_path and $php_ext) or
        ($tcpdf_ref and $stacktrace and $uncaught)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-76210 - phpMyFAQ PDF Export Local File Disclosure Attempt";
    flow:established,to_server;
    http.uri;
    content:"export";
    http.uri;
    content:"pdf";
    http.uri;
    content:"content";
    http.uri;
    content:"core";
    http.uri;
    content:"config";
    http.uri;
    content:"database.php";
    sid:2026762101;
    rev:1;
    metadata:attack_target Web_Server, created_at 2026_01_15, cve CVE-2026-76210, deployment Perimeter, tag cve, tag exploit, tag phpmyfaq, threat_category Web Application Attack;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-76210;
    classtype:attempted-user;
)

Note: The above rule tracks the path disclosure pattern in the HTTP request. A complementary server-side rule (using http.server_body) can be written to detect stack-trace disclosure in HTTP responses matching "Uncaught" and "Stack trace" patterns originating from the phpMyFAQ PDF endpoint path.

Elastic Detection

any where process.name == "php-fpm" or process.name == "apache2" or process.name == "nginx"

EQL requires process-level telemetry which is typically unavailable in web-application scenarios. The below EQL rule operates on application logs if PHP-FPM access/error logs are ingested.

// Correlation across HTTP access logs and PHP error logs
sequence by host.name with maxspan=5m
  [network where event.category == "web" and http.request.method == "GET" and
   url.path like "*export*" and url.path like "*pdf*"]
  [file where event.category == "file" and
   file.path like "*content/core/config/*" and file.name like "*.php"]
  [error where message like "*Uncaught*" and message like "*Stack trace*"]

Splunk SPL Query

index=web sourcetype="access_combined" 
| search "/export*" OR "*pdf*" 
| where like(uri_path, "%export%") OR like(uri_path, "%pdf%")
| join type=inner host [ 
    search index=os_logs sourcetype="php_errors" 
    | regex _raw="Uncaught.*(TCPDF|Exception)" 
    | regex _raw="Stack trace"
    | eval host=host_name 
    | fields host, _time, _raw 
    | rename _raw as php_error_log 
    | eval match_time=_time 
] 
| stats count by src_ip, dest_ip, uri_path, php_error_log
| where count > 1

Wazuh OSSEC Rule

<group name="web,phpmyfaq,cve-2026-76210,">
  <rule id="108771" level="12">
    <decoded>unknown</decoded>
    <field name="url">\.*export.*pdf.*</field>
    <description>phpMyFAQ PDF export request with potential local file path in parameters (CVE-2026-76210)</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <var name="cve">CVE-2026-76210</var>
  </rule>
  <rule id="108772" level="15">
    <if_sid>2007621</if_sid>
    <regex>content/core/config/.*\.php</regex>
    <description>phpMyFAQ PDF export referencing internal configuration file content/core/config/database.php (CVE-2026-76210)</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <var name="cve">CVE-2026-76210</var>
  </rule>
  <rule id="108773" level="10">
    <regex>Uncaught.*Stack trace.*</regex>
    <description>phpMyFAQ PDF generation returned uncaught exception with stack trace content (CVE-2026-76210)</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <var name="cve">CVE-2026-76210</var>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — NVD and OSV independently confirm the fix in version 4.1.6).

1) Immediate Mitigations (applied before patching)

• Restrict FAQ authoring roles: Temporarily revoke create/edit permissions for non-trusted users. If business needs prevent this, require multi-actor review for all FAQ content changes.
• Verify zend.exception_string_param_max_len: Set this PHP directive to a low value (e.g., the default of 50) on all production instances. This limits the disclosed information to a short fragment even if exploitation attempts occur.
• Disable PHP display_errors: Set display_errors = Off in PHP production configuration to prevent stack traces from being rendered to the HTTP response body. This neutralizes the exfiltration channel entirely.
• Restrict file permissions: Ensure that content/core/config/database.php (and any other files under content/) are NOT world-readable by the web server user. File permissions of 600 on the configuration files prevent TCPDF from reading them even if the HTML injection succeeds.
• Web Application Firewall (WAF) rule: Deploy a WAF rule that blocks POST/GET requests to the PDF export endpoint containing content/ path traversals or <img tags with local file paths.

2) Patch / Upgrade Steps

• Upgrade to phpMyFAQ 4.1.6 or later. The fix addresses the insufficient sanitization of HTML content before PDF generation via TCPDF.
• After upgrading, verify that the PDF export path sanitization is enforced by testing a crafted FAQ entry containing <img src="content/core/config/database.php"> and confirming no exception or file content appears in the HTTP response.
• Review the phpMyFAQ release notes and changelog for 4.1.6 to understand the full scope of the sanitation change and any backward-compatibility considerations.

3) Long-Term Hardening

• Defense in depth: Implement a restrictive Content Security Policy (CSP) that blocks img-src directive from loading local file paths, limiting the ability of any HTML injection to reference internal files.
• Log monitoring: Configure SIEM alerting for the detection patterns described above (PDF export + stack trace patterns + file path references).
• Version hygiene: Enforce a policy of updating phpMyFAQ promptly on security releases. Track advisories via NVD, OSV, and the phpMyFAQ project's security announcements.
• Regular credential rotation: Rotate database credentials on a scheduled basis so that any undetected credential exfiltration has a finite shelf life.
• Least privilege for web application users: Ensure the web application runs with minimal OS-level privileges, and the MySQL user used by phpMyFAQ has only the minimum required database grants.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-76210
   • Official CVE record with the NVD description, CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and CWE-73 classification.
2. OSV Entry — https://osv.dev/vulnerability/CVE-2026-76210
   • Independent OSV record confirming the vulnerability and fix version (4.1.6). Used as a patch-confirmation source.
3. phpMyFAQ Project Release Notes — https://www.phpmyfaq.de/
   • Vendor project site; release notes and changelog for version 4.1.6 document the security fix.
4. CWE-73 Reference — https://cwe.mitre.org/data/definitions/73.html
   • Formal description of "External Control of File Name or Path," the vulnerability class underpinning this CVE.
5. PHP zend.exception_string_param_max_len Documentation — https://www.php.net/manual/en/ini.core.php
   • PHP configuration directive governing stack-trace string truncation; central to the severity variance described in this advisory.

Author's Note: No evidence of in-the-wild exploitation, ransomware campaigns, or advanced persistent threat (APT) actor usage of CVE-2026-76210 has been identified at the time of this report. The CISA KEV database does not list this CVE. The absence of this CVE from KEV and the low EPSS score (0.00286) indicate low active exploitation probability; however, the public PoC status and the high business impact of credential disclosure warrant prompt patching.