phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController::index() method handles file deletion for the media browser. …

phpMyFAQ versions prior to 4.1.1 contain a critical vulnerability in the MediaBrowserController::index() method that handles file deletion. The vulnerability allows path traversal attacks through the fileRemove action where user-supplied name parameters are concatenated with upload directory paths without proper validation. The FILTER_SANITIZE_SPECIAL_CHARS filter fails to prevent directory traversal sequences like '../'. Additionally, the endpoint lacks CSRF token validation, making it exploitable via CSRF attacks. The vulnerability enables attackers to delete files outside the intended directory structure. This issue has been patched in version 4.1.1.