CVE-2026-46360: phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQEDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46360?
CVE-2026-46360 is classified as a high severity stored cross-site scripting vulnerability.
How do I fix CVE-2026-46360?
To fix CVE-2026-46360, upgrade phpMyFAQ to version 4.1.2 or later.
What causes the vulnerability in CVE-2026-46360?
CVE-2026-46360 is caused by a limitation in the recursive entity decoding in the SvgSanitizer component.
Who is affected by CVE-2026-46360?
Users of phpMyFAQ versions prior to 4.1.2 are affected by CVE-2026-46360.
Can CVE-2026-46360 lead to sensitive data exposure?
Yes, CVE-2026-46360 can potentially lead to sensitive data exposure through stored XSS exploits.