CVE-2026-48488

Description

### Summary Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). ### Details **Affected File** : `phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php` <img width="810" height="427" alt="image" src="https://github.com/user-attachments/assets/6499a008-3ece-4291-8296-f1d3303ba35c" /> ### Impact - An attacker can generate SHA-1 collisions to bypass attachment protection - Risk of password cracking if database is compromised - Estimated cracking time: < 1 minute for standard attachment ### Solution **Use bcrypt:** ``` public function setPassword(string $password): void { $this->passwordHash = password_hash($password, PASSWORD_BCRYPT); } public function verifyPassword(string $plainPassword): bool { return password_verify($plainPassword, $this->passwordHash); } ```

How to fix CVE-2026-48488

To remediate CVE-2026-48488, upgrade the affected package to a fixed version below.

• —upgrade to 4.1.4 or later
• —upgrade to 4.1.4 or later

Is CVE-2026-48488 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 4.1.4
• from 0, < 4.1.4

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-48488
• PATCHgithub.com/thorsten/phpMyFAQ
• WEBgithub.com/thorsten/phpMyFAQ/commit/1aa9be6f8a2fa5c527c983826205229fc3129718
• WEBgithub.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcj