CVE-2026-111894: phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI
phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated phpMyFAQ content author can exploit it by adding an iframe with a data:text/html source to FAQ or News content. Exploitation requires a viewer to load the stored content.
Which deployments are affected?
phpMyFAQ versions from 3.2.1 before 4.1.9 are affected, as are versions from 4.2.0-alpha before 4.2.0-beta. The issue involves the content-cleaning path for FAQ and News content, where iframe data URIs can bypass the media-host allowlist.
What can the attacker do to viewers?
Injected JavaScript can be executed in the context of a viewer accessing the malicious FAQ or News entry. The advisory specifically notes phishing interfaces and top-frame redirects as possible outcomes.
How can teams identify potentially malicious existing content?
Review FAQ and News content created by authenticated authors for iframe elements whose source uses a data:text/html URI. Such entries may have bypassed the hostless media-host allowlist and been rendered through Twig's raw filter.