Key points
- phpMyFAQ versions before 4.1.9 and 4.2.0-beta contain a critical SQL injection vulnerability.
- The flaw allows unauthenticated users to read credentials and drop database tables.
- The issue stems from how the software handles single quotes in specific MySQL modes.
Administrators running phpMyFAQ must update their installations immediately to address a severe security flaw. The National Vulnerability Database rates CVE-2026-109573 as critical with a CVSS score of 9.2. This vulnerability exists in all versions prior to 4.1.9 and the 4.2.0-beta release. Failure to patch exposes the application to unauthorized data access and manipulation by remote attackers who do not need login credentials.
In plain English
The vulnerability allows attackers to inject malicious SQL commands into the application’s search function. Specifically, the flaw targets the autocomplete API endpoint. An attacker sends a Unicode character that looks like a right single quotation mark. The system normalizes this character into a standard ASCII quote. This conversion bypasses the security mechanism that normally escapes single quotes using backslashes. When the database runs in NO_BACKSLASH_ESCAPES mode, it treats these backslashes as literal characters rather than escape codes. This allows the injected SQL commands to execute successfully.
The background
The core issue lies within the PdoMysql::escape() function in phpMyFAQ. This function is responsible for sanitizing user input before it reaches the database. According to the NVD record, the weakness is classified as CWE-89, which denotes SQL injection. The vendor, Thorsten, is identified as the creator of the affected software. The specific interaction between Unicode normalization and the database engine’s escape handling creates the attack vector. Attackers can leverage this to read sensitive configuration secrets, modify existing records, or even drop entire tables from the database.
What changes now
Users must verify their current phpMyFAQ version against the affected list. Any installation running a version lower than 4.1.9 is vulnerable. The 4.2.0-beta release is also affected and should be updated. Administrators should check their database configuration for the NO_BACKSLASH_ESCAPES mode setting, as this mode is required for the exploit to succeed. While the vulnerability is critical, it requires specific database settings to be fully exploitable. Patching the software to version 4.1.9 or higher resolves the issue by correcting the escape handling logic.
What to do and how to stay safe: phpMyFAQ
- Verify your phpMyFAQ version and upgrade to 4.1.9 or later immediately if you are running an older release.
- Audit your MySQL or MariaDB configuration to check if NO_BACKSLASH_ESCAPES mode is enabled on the server.
- Monitor server logs for unusual search queries or Unicode characters in the autocomplete API endpoint.
- Restrict access to the API endpoints using firewall rules if immediate patching is not possible.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this phpMyFAQ vulnerability?
The National Vulnerability Database assigns CVE-2026-109573 a CVSS score of 9.2, rating it as critical.
Which versions of phpMyFAQ are affected by this SQL injection flaw?
All versions before 4.1.9 and the 4.2.0-beta release are affected by this vulnerability.
Can an attacker exploit this flaw without logging in?
Yes, the NVD record states that unauthenticated attackers can exploit this vulnerability to access data.
