Skip to content

Commit 733a84f

Browse files
thorstenthorsten
committed
4.0.16 and 4.1.0-RC
1 parent e5fc553 commit 733a84f

File tree

8 files changed

+96
-17
lines changed

8 files changed

+96
-17
lines changed

‎content/news/2025.md‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,21 @@ canonical: news/2025
55
layout: news_md.hbs
66
---
77

8+
### 2025-12-29
9+
10+
The phpMyFAQ Team would like to announce the availability of [phpMyFAQ 4.1.0-RC](/download),
11+
the "Chris Rea" release.
12+
This release fixes security vulnerabilities, improves the experimental plugin manager, fixes all reported bugs, and
13+
updates our third party dependencies.
14+
We also updated various bundled translations.
15+
Additionally, we also released [phpMyFAQ 4.0.16](/download), the "Perry Bamonte" release,
16+
which fixes the same security vulnerabilities.
17+
[Click here to find a detailed security advisory](/security/advisory-2025-12-29).
18+
819
### 2025-12-22
920

1021
The phpMyFAQ Team is pleased to announce [phpMyFAQ 4.0.15](/download), the "Rosa von Praunheim" release.
11-
This release fixes all reported bugs and we updated our third party dependencies.
22+
This release fixes all reported bugs, and we updated our third party dependencies.
1223

1324
### 2025-12-16
1425

‎content/security/advisory-2025-12-29.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
title: Security Advisory 2025-12-29
3+
description: Stored cross-site scripting (XSS) and unauthenticated config backup download vulnerability in phpMyFAQ
4+
canonical: security/advisory-2025-12-29
5+
---
6+
7+
## Authenticated SQL Injection in Configuration Update Functionality in phpMyFAQ
8+
9+
**Issued on::** 2025-12-29
10+
**Software::** phpMyFAQ <= 4.0.15
11+
**Risk::** High
12+
**Platforms::** all
13+
14+
The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.0.15 and earlier.
15+
16+
## Description
17+
18+
A stored cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in an
19+
administrator’s browser by registering a user whose display name contains HTML entities (e.g., &lt;img ...&gt;). When
20+
an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting
21+
in script execution in the admin context.
22+
23+
An unauthenticated remote attacker can trigger generation of a configuration backup ZIP via POST /api/setup/backup and
24+
then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files
25+
(e.g., database.php with database credentials), leading to high-impact information disclosure and potential follow-on
26+
compromise.
27+
28+
## Solution
29+
30+
The phpMyFAQ Team has released the new phpMyFAQ versions 4.0.16 and 4.1.0-RC, which fix the vulnerabilities. All
31+
users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.
32+
33+
## Workaround
34+
35+
There's no workaround except installing phpMyFAQ 4.0.15 or 4.1.0-RC.
36+
37+
## Thanks
38+
39+
The phpMyFAQ team would like to thank **eclipse07077** for the responsible disclosures of this vulnerability.

‎content/security/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ layout: none
1818

1919
## 2025
2020
<ul>
21+
<li><a href="/security/advisory-2025-12-29">Security Advisory 2025-12-29</a></li>
2122
<li><a href="/security/advisory-2025-11-15">Security Advisory 2025-11-15</a></li>
2223
<li><a href="/security/advisory-2025-10-03">Security Advisory 2025-10-03</a></li>
2324
<li><a href="/security/advisory-2025-01-02">Security Advisory 2025-01-02</a></li>

‎data/development.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
2-
"version": "4.1.0-beta.2",
2+
"version": "4.1.0-RC",
33
"zip": {
4-
"filesize": 18.31,
5-
"md5": "899043e2170b3f5efc593a7a9f25ed7b"
4+
"filesize": 18.51,
5+
"md5": "586d4c353f0c98c31b814fd8511e8c4c"
66
},
77
"targz": {
8-
"filesize": 14.09,
9-
"md5": "06751cac1174a5c3e7f3aae3aaff86c8"
8+
"filesize": 14.28,
9+
"md5": "28c7cbe97026c0b26b18ff646bac2815"
1010
}
1111
}

‎data/stable.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
2-
"version": "4.0.15",
2+
"version": "4.0.16",
33
"zip": {
44
"filesize": 18.29,
5-
"md5": "f96fc92d15a90eb52e468617dd41b7af"
5+
"md5": "4c159ac45aabf7bb24db197300db0e71"
66
},
77
"targz": {
88
"filesize": 14.96,
9-
"md5": "57d2753d84a648427358aff1ed35cfd3"
9+
"md5": "bfefd82bdefc34c054367cfd260e3377"
1010
}
1111
}

‎data/versions.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
2-
"stable": "4.0.15",
3-
"stable_released": "2025-12-22",
4-
"development": "4.1.0-beta.2",
5-
"development_released": "2025-12-16",
6-
"nightly": "nightly-2025-12-21",
7-
"nightly_released": "2025-12-21"
2+
"stable": "4.0.16",
3+
"stable_released": "2025-12-29",
4+
"development": "4.1.0-RC",
5+
"development_released": "2025-12-29",
6+
"nightly": "nightly-2025-12-28",
7+
"nightly_released": "2025-12-28"
88
}

‎src/app/advisories/page.tsx‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ export default function AdvisoriesPage() {
1717

1818
<h2>2025</h2>
1919
<ul>
20+
<li>
21+
<Link href="/security/advisory-2025-12-29">Security Advisory 2025-12-29</Link>
22+
</li>
2023
<li>
2124
<Link href="/security/advisory-2025-11-15">Security Advisory 2025-11-15</Link>
2225
</li>

‎src/app/changelog/page.tsx‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ export default function ChangelogPage() {
2222
2323
2424
<h3 className="mt-4 mb-2">
25-
<a id="4.1.0-beta"></a>
26-
phpMyFAQ 4.1.0-beta - 2025-11-22
25+
<a id="4.1.0-RC"></a>
26+
phpMyFAQ 4.1.0-RC - 2025-12-29
2727
</h3>
2828
<ul className="list-unstyled ms-3">
2929
<li className="mb-1">changed PHP requirement to PHP 8.3 or later</li>
@@ -43,14 +43,30 @@ export default function ChangelogPage() {
4343
<li className="mb-1">added support for OpenSearch</li>
4444
<li className="mb-1">added support for .env files</li>
4545
<li className="mb-1">added support for Mago</li>
46+
<li className="mb-1">added ESLint configuration</li>
4647
<li className="mb-1">added experimental support for FrankenPHP</li>
4748
<li className="mb-1">added experimental support for LDAP group support</li>
4849
<li className="mb-1">added experimental MCP Server</li>
4950
<li className="mb-1">added experimental update via command line</li>
5051
<li className="mb-1">added experimental support for PHP 8.6</li>
5152
<li className="mb-1">improved online update feature</li>
53+
<li className="mb-1">improved experimental plugin manager</li>
5254
<li className="mb-1">updated Spanish translation</li>
5355
<li className="mb-1">updated Japanese translation</li>
56+
<li className="mb-1">updated French translation</li>
57+
<li className="mb-1">updated Portuguese and Brazilian Portuguese translation</li>
58+
<li className="mb-1">updated Turkish translation</li>
59+
<li className="mb-1">updated Dutch translation</li>
60+
<li className="mb-1">updated Norwegian (Bokmål) translation</li>
61+
<li className="mb-1">updated Italian translation</li>
62+
<li className="mb-1">updated Finnish translation</li>
63+
<li className="mb-1">updated Chinese (Simplified) and Chinese (Traditional) translations</li>
64+
<li className="mb-1">updated Hungarian translation</li>
65+
<li className="mb-1">updated Mongolian translation</li>
66+
<li className="mb-1">updated Arabic translation</li>
67+
<li className="mb-1">updated Basque translation</li>
68+
<li className="mb-1">updated Bengali translation</li>
69+
<li className="mb-1">updated Bosnian translation</li>
5470
<li className="mb-1">updated to PHPUnit v12</li>
5571
<li className="mb-1">migrated codebase to use PHP 8.3 language features</li>
5672
<li className="mb-1">migrated from WYSIWYG editor from TinyMCE to Jodit Editor</li>
@@ -63,6 +79,15 @@ export default function ChangelogPage() {
6379
phpMyFAQ 4.0.x
6480
</h2>
6581
82+
<h3 className="mt-4 mb-2">
83+
<a id="4.0.16"></a>
84+
phpMyFAQ 4.0.16 - 2025-12-29
85+
</h3>
86+
<ul className="list-unstyled ms-3">
87+
<li className="mb-1">fixed security vulnerabilities</li>
88+
<li className="mb-1">updated third party dependencies</li>
89+
</ul>
90+
6691
<h3 className="mt-4 mb-2">
6792
<a id="4.0.15"></a>
6893
phpMyFAQ 4.0.15 - 2025-12-22

0 commit comments

Comments
 (0)