CVE-2026-111903: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQEDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs an account with the FAQ_EDIT permission and must be able to upload a crafted SVG file. Exploitation also requires a viewer to click the malicious SVG link.
Which deployments are affected?
The affected version range is phpMyFAQ 4.2.0-alpha before 4.2.0-beta. The provided data does not state whether SVG upload capability or the relevant permissions are enabled by default.
What is the likely impact if exploitation succeeds?
The crafted SVG can execute JavaScript in the viewer's browser when its link is clicked. The described impact includes hijacking administrator sessions, with confidentiality and integrity impact rated low.