phpMyFAQ contains a CSV injection vulnerability
Date: 2025-12
Affected: composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq
Attack vector: rce
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-53929
CWE: CWE-1236
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user data as a CSV file.


Mitigations:

Architectural layers (MAESTRO):