CVE-2024-55889: thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames

December 13, 2024 (updated August 14, 2025)

A vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim’s machine upon page visit by embedding it in an element without user interaction or explicit consent.

References

github.com/advisories/GHSA-m3r7-8gw7-qwvc
github.com/thorsten/phpMyFAQ
github.com/thorsten/phpMyFAQ/commit/fa0f7368dc3288eedb1915def64ef8fb270f711d
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m3r7-8gw7-qwvc
nvd.nist.gov/vuln/detail/CVE-2024-55889

Code Behaviors & Features

Detect and mitigate CVE-2024-55889 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →