Stored Cross-Site Scripting in phpMyFAQ Affects User Sessions

CVE-2026-111903

What is CVE-2026-111903?

The phpMyFAQ application prior to version 4.2.0-beta is susceptible to a stored cross-site scripting vulnerability within the SvgSanitizer component. This arises from the ability of unauthorized users with the FAQ_EDIT permission to upload SVG files that include custom XML DTD entities. Such entities can trigger JavaScript execution upon user interaction, thereby compromising admin session security when exploited. This issue highlights the importance of proper sanitization of user-uploaded content to mitigate XSS risks.

References