GHSA-88G4-74F3-63X9中危已审查

phpMyFAQ has Potential Authenticated Path Traversal in PDF Export

OSV 1.4.0 · github-reviewed · 修改于 2026-08-26 01:28

发布时间

2026-08-26 01:28

GitHub 审查时间

2026-08-26 01:28

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/08/GHSA-88g4-74f3-63x9/GHSA-88g4-74f3-63x9.json

公告说明

Summary

There is an authenticated path traversal condition in the PDF export functionality, specifically within the PDF image resolution logic.

The issue may allow a privileged FAQ editor to cause the application to attempt reading files outside the intended content directory during PDF generation.

Affected Component

File: src/phpMyFAQ/Export/Pdf/Wrapper.php

Function: concatenatePaths()

Root Cause

The path resolution logic relies on locating the substring "content" within a user-controlled path:

$pos = strpos($trimmedFile, 'content');
$relativePath = substr($trimmedFile, (int) $pos);

If "content" is not present, strpos() returns false, which becomes 0 when cast to an integer.

As a result, the entire attacker-controlled path is preserved.

Example:

$trimmedFile = "../../../etc/passwd";
$pos = false;
$relativePath = "../../../etc/passwd";

The resulting path is later processed by:

file_get_contents($resolvedPath);

without canonicalization or a root-directory containment check.

Observed Data Flow

FAQ Content
    ->
PDF Export
    ->
WriteHTML()
    ->
Wrapper::Image()
    ->
concatenatePaths()
    ->
file_get_contents()

Potential Impact

Based on code review, a user with FAQ editing privileges may be able to store HTML containing crafted image paths that are processed during PDF generation.

Potential consequences may include:

Path traversal outside the intended content directory
Local file read attempts during PDF export
Possible disclosure of readable files depending on file type, sanitization behavior, and PDF rendering constraints

Discovery Method

This issue was initially detected by an internally developed SAST tool during analysis of the phpMyFAQ source code.

A user with FAQ editing privileges creates or modifies a FAQ entry.
The FAQ content contains an HTML image tag with a crafted relative path that does not include the expected content directory reference.
The HTML content is stored and later processed by the PDF export functionality.
When a user requests the PDF version of the FAQ, the application invokes WriteHTML(), which eventually reaches Wrapper::Image().
concatenatePaths() constructs a filesystem path without canonicalization or directory containment validation.
The resulting path reaches file_get_contents(), causing the application to attempt reading a file outside the intended content directory.
Depending on sanitization behavior, file permissions, image validation, and PDF rendering behavior, the contents of the targeted file may potentially be exposed to the PDF consumer.

标识信息

别名 / CVE

无

CWE

CWE-22

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-88g4-74f3-63x9",
  "aliases": [],
  "details": "## Summary\n\nThere is an authenticated path traversal condition in the PDF export functionality, specifically within the PDF image resolution logic.\n\nThe issue may allow a privileged FAQ editor to cause the application to attempt reading files outside the intended content directory during PDF generation.\n\n---\n\n## Affected Component\n\n**File:**\n`src/phpMyFAQ/Export/Pdf/Wrapper.php`\n\n**Function:**\n`concatenatePaths()`\n\n---\n\n## Root Cause\n\nThe path resolution logic relies on locating the substring `\"content\"` within a user-controlled path:\n\n```php\n$pos = strpos($trimmedFile, 'content');\n$relativePath = substr($trimmedFile, (int) $pos);\n```\n\nIf `\"content\"` is not present, `strpos()` returns `false`, which becomes `0` when cast to an integer.\n\nAs a result, the entire attacker-controlled path is preserved.\n\nExample:\n\n```php\n$trimmedFile = \"../../../etc/passwd\";\n$pos = false;\n$relativePath = \"../../../etc/passwd\";\n```\n\nThe resulting path is later processed by:\n\n```php\nfile_get_contents($resolvedPath);\n```\n\nwithout canonicalization or a root-directory containment check.\n\n---\n\n## Observed Data Flow\n\n```text\nFAQ Content\n    ->\nPDF Export\n    ->\nWriteHTML()\n    ->\nWrapper::Image()\n    ->\nconcatenatePaths()\n    ->\nfile_get_contents()\n```\n\n---\n\n## Potential Impact\n\nBased on code review, a user with FAQ editing privileges may be able to store HTML containing crafted image paths that are processed during PDF generation.\n\nPotential consequences may include:\n\n- Path traversal outside the intended content directory\n- Local file read attempts during PDF export\n- Possible disclosure of readable files depending on file type, sanitization behavior, and PDF rendering constraints\n\n---\n\n## Discovery Method\n\nThis issue was initially detected by an internally developed SAST tool during analysis of the phpMyFAQ source code.\n\nThe finding was then manually investigated and validated through code review.\n\nWhile the original scanner output classified the issue as a generic path traversal/local file inclusion pattern, manual analysis identified the specific root cause in the path resolution logic of `concatenatePaths()`.\n\n---\n\n## Potential Exploitation Scenario\n\nThe following scenario is based on code review and intended to illustrate the potential impact:\n\n1. A user with FAQ editing privileges creates or modifies a FAQ entry.\n\n2. The FAQ content contains an HTML image tag with a crafted relative path that does not include the expected `content` directory reference.\n\n3. The HTML content is stored and later processed by the PDF export functionality.\n\n4. When a user requests the PDF version of the FAQ, the application invokes `WriteHTML()`, which eventually reaches `Wrapper::Image()`.\n\n5. `concatenatePaths()` constructs a filesystem path without canonicalization or directory containment validation.\n\n6. The resulting path reaches `file_get_contents()`, causing the application to attempt reading a file outside the intended content directory.\n\n7. Depending on sanitization behavior, file permissions, image validation, and PDF rendering behavior, the contents of the targeted file may potentially be exposed to the PDF consumer.\n\nBased on my current analysis, exploitation would require a user capable of editing FAQ content and is therefore not considered an anonymous or unauthenticated attack vector.\n\n---\n\n## Suggested Remediation\n\nConsider replacing substring-based path anchoring with:\n\n- `realpath()` canonicalization\n- Strict root-directory containment checks\n- Explicit allowlisting of permitted image locations",
  "summary": "phpMyFAQ has Potential Authenticated Path Traversal in PDF Export",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "4.0.0-alpha"
            },
            {
              "fixed": "4.1.5"
            }
          ]
        }
      ],
      "package": {
        "name": "thorsten/phpmyfaq",
        "ecosystem": "Packagist"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 4.1.4"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "4.0.0-alpha"
            },
            {
              "fixed": "4.1.5"
            }
          ]
        }
      ],
      "package": {
        "name": "phpmyfaq/phpmyfaq",
        "ecosystem": "Packagist"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 4.1.4"
      }
    }
  ],
  "modified": "2026-08-25T17:28:56Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2026-08-25T17:28:56Z",
  "references": [
    {
      "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-88g4-74f3-63x9",
      "type": "WEB"
    },
    {
      "url": "https://github.com/thorsten/phpMyFAQ/commit/91ce64405479933d7d62c751fa79c2f5c6fda591",
      "type": "WEB"
    },
    {
      "url": "https://github.com/thorsten/phpMyFAQ/commit/b709ebe69405385785c2a74ae940c3e8d4cd0a8b",
      "type": "WEB"
    },
    {
      "url": "https://github.com/thorsten/phpMyFAQ",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-08-25T17:28:56Z"
  }
}