CVE-2026-111896: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs FAQ editor privileges and must be able to upload or store an SVG file through the affected application functionality. Exploitation also requires a victim to open the stored SVG.
What is the impact when exploitation succeeds?
Script embedded in the crafted SVG executes in the phpMyFAQ application origin when the file is opened. The vulnerability can affect confidentiality and integrity, and its scope is changed.
Which releases are affected?
The affected range is phpMyFAQ 4.2.0-alpha up to, but not including, 4.2.0-beta. The provided information does not identify affected stable releases or a workaround.