A path traversal vulnerability in phpMyFAQ allows authenticated administrators to delete arbitrary files, potentially resulting in system instability or denial of service.

The application is vulnerable to path traversal (CWE-22) within the category image deletion function. This vulnerability requires high privileges, specifically administrative access, to exploit.

An authenticated administrator can leverage this path traversal flaw to delete sensitive system files, which can cause significant service disruption or denial of service. While exploitation requires high privileges, the ability to delete arbitrary files presents a severe risk to system availability and administrative integrity. The CVSS score of 8.6 reflects the high impact of this vulnerability.

Immediate Action: Upgrade phpMyFAQ to version 4.1.6 or later to resolve the path traversal flaw.

Proactive Monitoring: Review administrative access logs for unusual deletion requests and monitor file integrity for critical system directories.

Compensating Controls: Restrict access to administrative interfaces to trusted IP addresses only and ensure the web server service account has minimal file system permissions.

Public Exploit Available: Unknown

Users of phpMyFAQ must upgrade to version 4.1.6 as soon as possible to prevent unauthorized file deletion. Given that this vulnerability requires administrative access, strengthen authentication mechanisms, such as enforcing multi-factor authentication, to prevent unauthorized account takeover.