Stored Cross-Site Scripting in phpMyFAQ Leads to SVG File Execution

CVE-2026-111896

What is CVE-2026-111896?

phpMyFAQ versions prior to 4.2.0-beta contain a stored cross-site scripting vulnerability within SvgSanitizer, permitting FAQ editors to upload executable SVG files. Attackers can manipulate script tags, allowing them to circumvent single-pass removal mechanisms. Once this file is accessed by victims, the embedded scripts may execute in the application origin, potentially leading to malicious outcomes. Organizations using affected versions are advised to upgrade promptly to mitigate related security risks.

References