CVE-2026-48488: phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing

June 23, 2026

Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered).

References

github.com/advisories/GHSA-58fg-62fg-3fcj
github.com/thorsten/phpMyFAQ/commit/1aa9be6f8a2fa5c527c983826205229fc3129718
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-58fg-62fg-3fcj
nvd.nist.gov/vuln/detail/CVE-2026-48488

Code Behaviors & Features

Detect and mitigate CVE-2026-48488 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →