GHSA-58fg-62fg-3fcj CVE-2026-48488

phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

Low Packagist

Severity: 0.0 / 10; Low · CVSS 4.0
Exploit chance (EPSS): 0.18%; Chance of exploitation in the next 30 days. Higher than 7.80% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-328 Use of Weak Hash
Fix: Available; 2 packages have a fixed version

Description

Summary

Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered).

Details

Affected File : phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php

Impact

An attacker can generate SHA-1 collisions to bypass attachment protection
Risk of password cracking if database is compromised
Estimated cracking time: < 1 minute for standard attachment

Solution

Use bcrypt:

public function setPassword(string $password): void
{
    $this->passwordHash = password_hash($password, PASSWORD_BCRYPT);
}

public function verifyPassword(string $plainPassword): bool
{
    return password_verify($plainPassword, $this->passwordHash);
}

Affected versions

Packagist

Package	Vulnerable	Fixed in
phpmyfaq/phpmyfaq	`< 4.1.4`	`4.1.4`
thorsten/phpmyfaq	`< 4.1.4`	`4.1.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

phpmyfaq/phpmyfaq Packagist → `4.1.4`

composer

composer require phpmyfaq/phpmyfaq:^4.1.4

thorsten/phpmyfaq Packagist → `4.1.4`

composer

composer require thorsten/phpmyfaq:^4.1.4

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): Low
Integrity (vulnerable system): None
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None
Exploit maturity: Unreported

Weakness

CWE-328: Use of Weak Hash

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

How to prevent it

Architecture and Design: Use an adaptive hash function that can be configured to change the amount of computational effort needed to compute the hash, such as the number of iterations ("stretching") or the amount of memory required. Some hash functions perform salting automatically. These functions can significantly increase the overhead for a brute force attack compared to intentionally-fast functions such as MD5. For example, rainbow table attacks can become infeasible due to the high computing overhead. Finally, since computing power gets faster and cheaper over time, the technique can be reconfigured to increase the workload without forcing an entire replacement of the algorithm in use. Some hash functions that have one or more of these desired properties include bcrypt [REF-291], scrypt [REF-292], and PBKDF2 [REF-293]. While there is active debate about which of these is the most effective, they are all stronger than using salts with hash functions with very little computing overhead. Note that using these functions can have an impact on performance, so they require special consideration to avoid denial-of-service attacks. However, their configurability provides finer control over how much CPU and memory is used, so it could be adjusted to suit the environment's needs.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-48488

Packages

github.com/thorsten/phpMyFAQ

Timeline

Jun 8, 2026 Published
Sep 10, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-rw77-vq4g-x3hp phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion	High	Also affects phpmyfaq/phpmyfaq
GHSA-8gpw-xvpf-hvx5 phpMyFAQ's two-factor authentication login bypasses the password factor	High	Also affects phpmyfaq/phpmyfaq
GHSA-pgwp-vc7q-cvj3 phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission	High	Also affects phpmyfaq/phpmyfaq
GHSA-6pvm-2vjj-rx4w phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration	Medium	Also affects thorsten/phpmyfaq
GHSA-mf8r-wm2w-f8c5 phpMyFAQ public FAQ APIs expose inactive FAQ content	Medium	Also affects phpmyfaq/phpmyfaq
GHSA-88g4-74f3-63x9 phpMyFAQ has Potential Authenticated Path Traversal in PDF Export	Medium	Also affects phpmyfaq/phpmyfaq
GHSA-pg62-f8g4-4wqh phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold	High	Also affects phpmyfaq/phpmyfaq
GHSA-985r-q3qp-299h phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards	High	Also affects phpmyfaq/phpmyfaq

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor