CVE-2026-48488: phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

June 23, 2026

Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered).

References

github.com/advisories/GHSA-58fg-62fg-3fcj
github.com/thorsten/phpMyFAQ/commit/1aa9be6f8a2fa5c527c983826205229fc3129718
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcj
nvd.nist.gov/vuln/detail/CVE-2026-48488

Code Behaviors & Features

Detect and mitigate CVE-2026-48488 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →