CVE-2025-69200
High · 7.5phpMyFAQ has unauthenticated config backup download via /api/setup/backup
CVSS
7.5
EPSS
2.1%
Published
Dec 30, 2025
CISA due date
—
The record
An unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | thorsten/phpmyfaq | 0 | 4.0.16 |
| Packagist | thorsten/phpmyfaq | 4.1.0-alpha | No fix |
| packagist | thorsten/phpmyfaq | 4.1.0-alpha | No fix |
Related vulnerabilities
- GHSA-9cg9-4h4f-j6fg phpMyFAQ has unauthenticated config backup download via /api/setup/backup Same vulnerability
- GHSA-w22q-m2fm-x9f4 phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint Also affects thorsten/phpmyfaq
- CVE-2026-27836 phpMyFAQ is an open source FAQ web application. Also affects thorsten/phpmyfaq
- CVE-2026-24420 phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) Also affects thorsten/phpmyfaq
- CVE-2026-24421 phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing) Also affects thorsten/phpmyfaq
- CVE-2026-24422 phpMyFAQ: Public API endpoints expose emails and invisible questions Also affects thorsten/phpmyfaq
- GHSA-jv8r-hv7q-p6vc phpMyFAQ has Stored XSS in user list via admin-managed display_name Also affects thorsten/phpmyfaq
- CVE-2025-68951 phpMyFAQ has Stored XSS in user list via admin-managed display_name Also affects thorsten/phpmyfaq