What is GHSA-2mwq-hcmq-fqq4?

GHSA-2mwq-hcmq-fqq4 is a security advisory published by GitHub Security Advisories with Medium severity. phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at...

Which CVE IDs does GHSA-2mwq-hcmq-fqq4 cover?

GHSA-2mwq-hcmq-fqq4 covers the following CVE IDs: CVE-2026-75920. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2mwq-hcmq-fqq4?

GHSA-2mwq-hcmq-fqq4 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-2mwq-hcmq-fqq4MediumCVSS 5.3

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at...

Vendor

GitHub Security Advisories

Published

August 19, 2026

Last Modified

August 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-75920 →

📋 Description

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive.

🔗 References (4)

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8hmh-mrx6-pqvf
https://nvd.nist.gov/vuln/detail/CVE-2026-75920
https://www.vulncheck.com/advisories/phpmyfaq-before-information-disclosure-via-backup-zip
https://github.com/advisories/GHSA-2mwq-hcmq-fqq4