CVE-2026-66398

This CVE (CVSS 9.4) chains two privileges that phpMyFAQ treats as independent: CONFIGURATION_EDIT allows modifying settings like upgrade.lastDownloadedPackage, and ATTACHMENT_ADD permits uploading ZIP archives. Individually these seem contained. Together, they let an admin with both privileges rewrite the upgrade configuration to point the extraction path to the web root, then trigger the upgrade process to extract a malicious archive — achieving remote code execution. The key insight here is that this isn't a missing sanitization check. The configuration system trusts its own settings to govern dangerous operations (root-level file extraction) without verifying whether the caller has any business controlling that path. The privilege model treats CONFIGURATION_EDIT as a monolithic capability, with no awareness that some configuration values are data and others are attack surface. For defenders: audit your admin role assignments immediately. Check whether any role combines CONFIGURATION_EDIT and ATTACHMENT_ADD — this is likely true for many default installations. If both privileges exist on a single role, that role effectively has RCE capability regardless of its nominal permission level. The remediation isn't just patching; it's recognizing that certain privilege combinations create escalation paths that shouldn't exist in a properly segmented model. Consider whether CONFIGURATION_EDIT should be further segmented so that settings governing file paths and upgrade operations require additional capability checks, or whether the upgrade mechanism should validate extraction targets independently of whatever the configuration layer reports. The EPSS score of 0.00241 reflects the specificity of the required conditions — this isn't opportunistic exploitation. But for targeted scenarios where an attacker already has admin-level access (insider threat, compromised credentials, or post-exploitation lateral movement), this vulnerability closes the gap to full system compromise with trivial effort.

Reviewed through automated stages and approved by a human before publication.