---
id: CVE-2026-48488
title: phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
summary: phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
severity: low
cwe:
  - CWE-328
vendor: thorsten
product: thorsten/phpmyfaq
ecosystem: composer
affected:
  - thorsten/phpmyfaq <= 4.1.3
  - phpmyfaq/phpmyfaq <= 4.1.3
patched:
  - thorsten/phpmyfaq 4.1.4
  - phpmyfaq/phpmyfaq 4.1.4
published: '2026-06-23'
updated: '2026-06-23'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-58fg-62fg-3fcj'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcj
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48488'
  - url: >-
      https://github.com/thorsten/phpMyFAQ/commit/1aa9be6f8a2fa5c527c983826205229fc3129718
  - url: 'https://github.com/advisories/GHSA-58fg-62fg-3fcj'
tags:
  - ghsa
  - composer
epss: 0.00182
epssPercentile: 0.08029
ingestedAt: '2026-06-26T16:43:14.606Z'
---

## Overview

### Summary

Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered).

### Details

**Affected File** : `phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php`

<img width="810" height="427" alt="image" src="https://github.com/user-attachments/assets/6499a008-3ece-4291-8296-f1d3303ba35c" />


### Impact

- An attacker can generate SHA-1 collisions to bypass attachment protection
- Risk of password cracking if database is compromised
- Estimated cracking time: < 1 minute for standard attachment

### Solution

**Use bcrypt:**

```
public function setPassword(string $password): void
{
    $this->passwordHash = password_hash($password, PASSWORD_BCRYPT);
}

public function verifyPassword(string $plainPassword): bool
{
    return password_verify($plainPassword, $this->passwordHash);
}
```

## Affected packages

- `thorsten/phpmyfaq <= 4.1.3`
- `phpmyfaq/phpmyfaq <= 4.1.3`

## Remediation

Upgrade to a patched release:

- `thorsten/phpmyfaq 4.1.4`
- `phpmyfaq/phpmyfaq 4.1.4`