Skip to content

Commit 72f8567

Browse files
thorstenthorsten
committed
4.1.3
1 parent 4a7f8f9 commit 72f8567

14 files changed

Lines changed: 70 additions & 25 deletions

File tree

‎content/changelog/index.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@ canonical: changelog
66

77
## phpMyFAQ 4.1.x
88

9+
### phpMyFAQ 4.1.3 - 2026-05-14 {#4.1.3}
10+
11+
- fixed security vulnerabilities
12+
- updated third party dependencies
13+
- fixed bugs
14+
915
### phpMyFAQ 4.1.2 - 2026-04-28 {#4.1.2}
1016

1117
- fixed security vulnerabilities

‎content/news/2026.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ description: What happened this year so far?
44
canonical: news/2026
55
---
66

7+
### 2026-03-31
8+
9+
The phpMyFAQ Team is pleased to announce [phpMyFAQ 4.1.3](/download), the "Alessandro Zanardi" releases.
10+
This release fixes security vulnerabilities, updates all third party dependencies, and fixes all reported bugs.
11+
[Click here to find a detailed security advisory](/security/advisory-2026-05-14).
12+
713
### 2026-04-28
814

915
The phpMyFAQ Team would like to announce the availability of [phpMyFAQ 4.1.2](/download), the "Mario Adorf" releases.
@@ -16,7 +22,6 @@ The phpMyFAQ Team is pleased to announce [phpMyFAQ 4.1.1](/download), the "Chuck
1622
This release fixes security vulnerabilities, updates all third party dependencies, and fixes all reported bugs.
1723
[Click here to find a detailed security advisory](/security/advisory-2026-03-31).
1824

19-
2025
### 2026-03-12
2126

2227
[phpMyFAQ 4.1.0](/download), the "Neil Sedaka" release, is here. This release brings a modernized platform with PHP 8.3+ support, TypeScript, Vite 7, Vitest 4, Jodit Editor, Symfony routing in the admin backend, and many new administration features.

‎content/security/advisory-2026-05-14.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
title: Security Advisory 2026-05-14
3+
description: Multiple vulnerabilities in phpMyFAQ
4+
canonical: security/advisory-2026-05-14
5+
---
6+
7+
## Multiple vulnerabilities in phpMyFAQ
8+
9+
**Issued on::** 2026-05-14
10+
**Software::** phpMyFAQ <= 4.1.2
11+
**Risk::** High
12+
**Platforms::** all
13+
14+
The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.2 and earlier.
15+
16+
## Description
17+
18+
phpMyFAQ contains an authentication bypass vulnerability where the default empty API token allows unauthorized access to protected endpoints.
19+
An Insecure Direct Object Reference (IDOR) flaw in phpMyFAQ enables attackers to take over arbitrary user accounts by manipulating object identifiers.
20+
An unauthenticated password reset endpoint in phpMyFAQ permits user enumeration and forces password changes without validating the reset token.
21+
A missing password reset token check in phpMyFAQ allows account takeover through username and email enumeration.
22+
23+
## Solution
24+
25+
The phpMyFAQ Team has released the new phpMyFAQ version 4.1.3, which fixes the vulnerabilities. All
26+
users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version.
27+
28+
## Workaround
29+
30+
There's no workaround except installing phpMyFAQ 4.1.3.
31+
32+
## Thanks
33+
34+
The phpMyFAQ team would like to thank **guayu-kakeru**, **i.cyber.sa**, and **kitu232** for the responsible disclosures of these vulnerabilities.

‎data/stable.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
2-
"version": "4.1.2",
2+
"version": "4.1.3",
33
"zip": {
4-
"filesize": 18.81,
5-
"md5": "b454eb68eaa6171846a244098dbb8fbf"
4+
"filesize": 18.84,
5+
"md5": "e313a75e7d308944af4d9871449486cd"
66
},
77
"targz": {
8-
"filesize": 14.6,
9-
"md5": "e36c15bed6f5b403c90606242174e7fa"
8+
"filesize": 14.61,
9+
"md5": "9e201aa2e831675a27b461befcc6c70a"
1010
}
1111
}

‎data/versions.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
2-
"stable": "4.1.2",
3-
"stable_released": "2026-04-28",
2+
"stable": "4.1.3",
3+
"stable_released": "2026-05-14",
44
"development": "4.1.0-RC.7",
55
"development_released": "2026-02-27",
6-
"nightly": "nightly-2026-04-27",
7-
"nightly_released": "2026-04-27"
6+
"nightly": "nightly-2026-05-13",
7+
"nightly_released": "2026-05-13"
88
}

‎public/api/news/2020.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"generated": "2026-05-03T14:44:29.962Z",
2+
"generated": "2026-05-03T15:58:15.307Z",
33
"year": "2020",
44
"total": 12,
55
"news": [

‎public/api/news/2021.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"generated": "2026-05-03T14:44:29.962Z",
2+
"generated": "2026-05-03T15:58:15.307Z",
33
"year": "2021",
44
"total": 5,
55
"news": [

‎public/api/news/2022.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"generated": "2026-05-03T14:44:29.962Z",
2+
"generated": "2026-05-03T15:58:15.307Z",
33
"year": "2022",
44
"total": 13,
55
"news": [

‎public/api/news/2023.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"generated": "2026-05-03T14:44:29.962Z",
2+
"generated": "2026-05-03T15:58:15.307Z",
33
"year": "2023",
44
"total": 20,
55
"news": [

‎public/api/news/2024.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"generated": "2026-05-03T14:44:29.962Z",
2+
"generated": "2026-05-03T15:58:15.307Z",
33
"year": "2024",
44
"total": 18,
55
"news": [

0 commit comments

Comments
 (0)