{"id":"CVE-2026-116182","kind":"vulnerability","aliases":["CVE-2026-116182"],"related":[],"title":"phpMyFAQ: PDF export fetches internal URLs from FAQ images","description":"phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them and embed responses in generated PDFs.","summary":"phpMyFAQ before 4.1.10 fetches external images referenced in FAQ answers when generating PDF exports. An attacker who can write FAQ content can point those image URLs at loopback or internal services, so the server requests them and embeds the responses in the generated PDF.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["fixed-version","no-pdf-export","trusted-editors-only"],"how_to_check":"- Check the installed phpMyFAQ version (`4.1.10` or later is fixed; anything earlier is affected).\n- Confirm whether untrusted users can edit FAQ content.\n- unknown","fix":"- Upgrade phpMyFAQ to `4.1.10` or later.\n- unknown","status":"open","published_at":"2026-10-25T14:16:58+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:43:02+00:00","updated_at":"2026-10-25T14:43:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:43:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.1.10` or later.\n- unknown","reach":"internet","title":"phpMyFAQ: PDF export fetches internal URLs from FAQ images","impact":"medium","summary":"phpMyFAQ before 4.1.10 fetches external images referenced in FAQ answers when generating PDF exports. An attacker who can write FAQ content can point those image URLs at loopback or internal services, so the server requests them and embeds the responses in the generated PDF.","category":"package","nicknames":[],"who_cares":["phpmyfaq","self-hosted","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server requests internal services and leaks their responses in PDFs","analyst_note":"Confirm from the NVD entry or the phpMyFAQ 4.1.10 release notes whether an account is required to write FAQ content and whether PDF export is on by default.","how_to_check":"- Check the installed phpMyFAQ version (`4.1.10` or later is fixed; anything earlier is affected).\n- Confirm whether untrusted users can edit FAQ content.\n- unknown","needs_analyst":true,"not_affected_if":["fixed-version","no-pdf-export","trusted-editors-only"],"who_is_affected":"Installations of phpMyFAQ older than 4.1.10 that use the PDF export feature are exposed. Exposure depends on whether untrusted people can add or edit FAQ answers, since they supply the image URLs. Sites where only trusted administrators write FAQ content face lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000625,"input_tokens":3332,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116182':12A,15A '-2026':11A,14A '4.1.10':24B,68C 'answer':31B,89C 'attack':37B,90C 'caus':106C 'contain':69C 'content':42B,95C 'cve':10A,13A 'emb':59B,97C,113C 'export':3A,35B,80C 'extern':26B,84C 'faq':8A,30B,41B,88C,94C 'featur':81C 'fetch':4A,25B,83C 'forgeri':75C 'generat':33B,64B,116C 'host':21B 'imag':9A,27B,46B,85C,98C 'influenc':93C 'intern':5A,51B,104C 'loopback':49B,102C 'packag':16B 'pdf':2A,34B,65B,79C 'pdfs':117C 'php':17B 'phpmyfaq':1A,18B,22B,66C 'point':44B,100C 'referenc':28B,86C 'request':56B,74C,110C 'respons':61B,114C 'self':20B 'self-host':19B 'server':55B,72C,108C 'server-sid':71C 'servic':52B,105C 'side':73C 'url':6A,47B,99C 'vulner':76C 'write':40B","nicknames":[],"mitigations":[],"who_affected":"Installations of phpMyFAQ older than 4.1.10 that use the PDF export feature are exposed. Exposure depends on whether untrusted people can add or edit FAQ answers, since they supply the image URLs. Sites where only trusted administrators write FAQ content face lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116182","severity":null,"published_at":"2026-10-25T14:16:58+00:00","modified_at":"2026-10-25T14:16:58+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}