Key points
- CVE-2026-109573 is rated CVSS 9.2 Critical by the National Vulnerability Database.
- The flaw affects phpMyFAQ versions prior to 4.1.9 and 4.2.0-beta.
- Attackers can read credentials and modify records without authentication.
The National Vulnerability Database has assigned a critical severity rating to a SQL injection flaw in phpMyFAQ, a popular open-source knowledge base system. According to the NVD record for CVE-2026-109573, the vulnerability carries a CVSS score of 9.2. This high score reflects the ease with which unauthenticated attackers can exploit the defect to compromise database integrity and steal sensitive configuration data from exposed instances.
How it unfolded
- The NVD published a record for CVE-2026-109573 identifying a critical SQL injection weakness in phpMyFAQ.
- The vulnerability stems from improper handling of Unicode characters in the search parameter of the autocomplete API.
- Attackers exploit this by sending a Unicode right single quotation mark that gets normalized to an ASCII quote.
Who is affected
Administrators running phpMyFAQ versions before 4.1.9 are affected by this vulnerability. The issue also impacts versions prior to 4.2.0-beta. The flaw exists within the PdoMysql::escape() function, which escapes single quotes using backslashes. This method fails when the underlying MySQL or MariaDB database is configured to run in NO_BACKSLASH_ESCAPES mode. In that specific configuration, the backslashes are treated as literal characters rather than escape sequences, leaving the SQL query open to injection.
The attack vector targets the api/autocomplete endpoint. An unauthenticated attacker can submit a search parameter containing a Unicode right single quotation mark. The application normalizes this Unicode character into a standard ASCII quote. Because the escaping mechanism is bypassed in NO_BACKSLASH_ESCAPES mode, the injected quote breaks out of the intended SQL string. This allows the attacker to append malicious SQL commands to the original query.
According to the NVD description, successful exploitation allows attackers to read credentials and configuration secrets stored in the database. Beyond data theft, the vulnerability enables attackers to modify existing records or drop entire database tables. This level of access poses a severe risk to the confidentiality, integrity, and availability of the knowledge base system and any connected services that rely on its stored credentials.
What happens next
System administrators must verify their phpMyFAQ installation version immediately. Those running versions earlier than 4.1.9 or 4.2.0-beta are exposed to this critical flaw. The vendor has released version 4.1.9 to address the issue. Updating to this patched version is the primary recommended action to mitigate the risk. Administrators should also review their database configuration settings, particularly the NO_BACKSLASH_ESCAPES mode, to understand how their environment handles escape characters.
Background: SQL injection
SQL injection occurs when attackers insert malicious code into database queries. Small organisations are exposed due to limited security budgets and custom software. Use parameterized queries, least-privilege database accounts, and web application firewalls to mitigate these risks without significant expense.
Read the full guide: SQL Injection Risks and Protection for Small Businesses
What to do and how to stay safe: phpMyFAQ
- Audit all phpMyFAQ installations to identify versions prior to 4.1.9 or 4.2.0-beta and update them immediately.
- Monitor web server logs for unusual activity on the api/autocomplete endpoint, specifically looking for Unicode characters in search parameters.
- Review database configuration files to check if NO_BACKSLASH_ESCAPES mode is enabled, as this setting exacerbates the vulnerability.
- Implement web application firewalls to block requests containing suspicious Unicode sequences that could be used for injection attacks.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109573?
The CVSS score for CVE-2026-109573 is 9.2, which is rated as Critical by the NVD.
Which phpMyFAQ versions are vulnerable to this SQL injection?
phpMyFAQ versions before 4.1.9 and before 4.2.0-beta are affected by this vulnerability.
How do attackers exploit this specific flaw?
Attackers send a Unicode right single quotation mark in the search parameter, which is normalized to an ASCII quote to bypass escaping.
