SVG Sanitizer Bypass in phpMyFAQ Leads to Privilege Escalation

CVE-2026-34974

What is CVE-2026-34974?

The SVG sanitizer in phpMyFAQ, an open-source FAQ application, is susceptible to a bypass due to improper handling of HTML entity encoding within javascript: URLs. This issue allows any user with edit_faq permissions to upload a malicious SVG file that can execute arbitrary JavaScript code when viewed. Consequently, this vulnerability may lead to unauthorized privilege escalation, allowing an editor to gain full administrative control over the application. This critical security flaw was addressed in version 4.1.1, which ensures robust filtering of SVG content.

References