phpMyFAQ has unauthenticated config backup download via /api/setup/backup

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

• CVE-2025-69200: 2.14% estimated exploitation activity in the next 30 days; percentile 82.07 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary An unauthenticated remote attacker can trigger generation of a configuration backup ZIP via POST /api/setup/backup and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., database.php with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Details The endpoint /api/setup/backup is reachable via default rewrite rules and does not enforce authentication/authorization or API token verification. When called with any non-empty body (used as an “installed version” string), the server creates a ZIP archive inside the configuration directory and returns a direct URL to the generated ZIP file. Relevant code paths: - Rewrite rule exposing the endpoint: - phpmyfaq/.htaccess: RewriteRule ^api/setup/(check|backup|update-database) api/index.php [L,QSA] - Controller implementation: - phpmyfaq/src/phpMyFAQ/Controller/Api/SetupController.php → backup() - No call to…

Published by the source

30 Dec 2025, 15:31 UTC

Last modified by the source

30 Dec 2025, 15:31 UTC

Source last checked

26 Oct 2026, 14:35 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-9cg9-4h4f-j6fg

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2025-69200

Advisory: phpMyFAQ has unauthenticated config backup download via /api/setup/backup
IDs: CVE-2025-69200, GHSA-9cg9-4h4f-j6fg
Record: https://patchnext.com/advisories/cve-2025-69200 (revision 1, source checked 26 Oct 2026, 14:35 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Partial vendor fix; fixed versions by package: thorsten/phpmyfaq 4.0.16. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist thorsten/phpmyfaq: affected < 4.0.16; >= 4.1.0-alpha, <= 4.1.0-beta.2; fixed in 4.0.16

## Suggested inspection (read-only)
- Packagist thorsten/phpmyfaq: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on thorsten/phpmyfaq.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-9cg9-4h4f-j6fg (GitHub-reviewed advisory GHSA-9cg9-4h4f-j6fg lists affected ranges: Packagist thorsten/phpmyfaq >=0 =4.1.0-alpha <=4.1.0-beta.2)

Commands are suggestions: review each one before running it.