CVE-2026-46361: phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass htmlentitydecode(striptags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46361?
CVE-2026-46361 has a high severity rating due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2026-46361?
To fix CVE-2026-46361, upgrade phpMyFAQ to version 4.1.2 or later to ensure autoescape protection is enabled.
Who is affected by CVE-2026-46361?
CVE-2026-46361 affects all versions of phpMyFAQ prior to 4.1.2.
What type of vulnerability is CVE-2026-46361?
CVE-2026-46361 is classified as a stored cross-site scripting vulnerability.
What can attackers do with CVE-2026-46361?
Attackers exploiting CVE-2026-46361 can inject malicious scripts into the search results, compromising the security of users accessing the phpMyFAQ application.