Live › vulnerability › CVE-2026-116182
Go to dashboardphpMyFAQ before 4.1.10 fetches external images referenced in FAQ answers when generating PDF exports. An attacker who can write FAQ content can point those image URLs at loopback or internal services, so the server requests them and embeds the responses in the generated PDF.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Installations of phpMyFAQ older than 4.1.10 that use the PDF export feature are exposed. Exposure depends on whether untrusted people can add or edit FAQ answers, since they supply the image URLs. Sites where only trusted administrators write FAQ content face lower risk.
No product ranges from the sources yet.
4.1.10 or later is fixed; anything earlier is affected).4.1.10 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them and embed responses in generated PDFs.
This page as .md · .json · in your agent: get_signal("CVE-2026-116182")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.