Key points
- The National Vulnerability Database rates CVE-2026-109573 as critical with a CVSS score of 9.2.
- The vulnerability exists in phpMyFAQ versions prior to 4.1.9 and before 4.2.0-beta.
- Attackers can exploit the issue by sending specific Unicode characters to the API endpoint.
The National Vulnerability Database has assigned a critical severity rating to a new SQL injection vulnerability identified in phpMyFAQ. The flaw, tracked as CVE-2026-109573, carries a CVSS score of 9.2, indicating a high potential for severe impact on affected systems. This rating reflects the ease with which unauthenticated attackers can exploit the issue to compromise database integrity and access sensitive information stored within the application.
In plain English
The vulnerability stems from how phpMyFAQ handles special characters in its database queries. Specifically, the PdoMysql::escape() function escapes single quotes using backslashes. This method fails when the underlying MySQL or MariaDB database is configured to run in NO_BACKSLASH_ESCAPES mode. In this mode, backslashes are treated as literal characters rather than escape sequences, allowing attackers to bypass the intended protection and inject malicious SQL commands into the database query.
The background
Attackers can trigger this flaw by sending a Unicode right single quotation mark in the search parameter of the api/autocomplete endpoint. The application normalizes this Unicode character into a standard ASCII quote, which then interacts with the flawed escaping logic. According to the NVD record, this allows unauthenticated users to read credentials and configuration secrets, modify database records, or even drop tables entirely. The issue affects phpMyFAQ versions before 4.1.9 and versions prior to 4.2.0-beta.
What changes now
Organizations running vulnerable versions of phpMyFAQ are exposed to significant risk. The ability to read configuration secrets means attackers could gain deeper access to the server or network if credentials are reused. The potential to drop tables indicates that data loss is a direct consequence of exploitation. Security teams must verify their current version and assess the database configuration to determine if they are using the vulnerable NO_BACKSLASH_ESCAPES mode, which enables the attack vector described in the advisory.
What to do and how to stay safe: phpMyFAQ
- Verify your phpMyFAQ version and upgrade to 4.1.9 or later if you are running an older release.
- Check your MySQL or MariaDB configuration to see if NO_BACKSLASH_ESCAPES is enabled, which facilitates this specific attack.
- Monitor access logs for unusual activity on the api/autocomplete endpoint, particularly requests containing Unicode characters.
- Restrict access to the autocomplete API to authenticated users if possible, reducing the attack surface for unauthenticated threats.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this phpMyFAQ vulnerability?
The vulnerability is tracked as CVE-2026-109573 in the National Vulnerability Database.
Which versions of phpMyFAQ are affected by this issue?
Versions before 4.1.9 and versions before 4.2.0-beta are affected by this SQL injection flaw.
How do attackers exploit this vulnerability?
Attackers send a Unicode right single quotation mark to the api/autocomplete search parameter, which is normalized to an ASCII quote to bypass escaping.
