GitHub Advisoryadvisory · Packagist

GHSA-58fg-62fg-3fcj phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

LOW Published 2026-06-23 Modified 2026-06-23 Official page ↗
Aliases
CVE-2026-48488
Ecosystem
Packagist
Packages
thorsten/phpmyfaq, phpmyfaq/phpmyfaq
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-328
Reviewed
2026-06-23

Affected packages

• Packagist thorsten/phpmyfaq: < 4.1.4 → fixed in 4.1.4 • Packagist phpmyfaq/phpmyfaq: < 4.1.4 → fixed in 4.1.4

Description

Summary Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Details Affected File : `phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php` Impact • An attacker can generate SHA-1 collisions to bypass attachment protection • Risk of password cracking if database is compromised • Estimated cracking time: passwordHash = password_hash($password, PASSWORD_BCRYPT); } public function verifyPassword(string $plainPassword): bool { return password_verify($plainPassword, $this->passwordHash); } ```

Related

Alias · CVE (1)

  • CVE-2026-48488 phpMyFAQ is an open source FAQ web application. vulnerability

Weakness · CWE (1)

  • CWE-328 Use of Weak Hash weakness

References