Stored Cross-Site Scripting Vulnerability in phpMyFAQ by phpMyFAQ
CVE-2026-46360

5.4MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
15 May 2026

What is CVE-2026-46360?

A stored cross-site scripting vulnerability exists in phpMyFAQ versions before 4.1.2 due to inadequate sanitization of SVG files. Specifically, in the SvgSanitizer::decodeAllEntities() function, a limit of 5 iterations on recursive entity decoding allows authenticated users with FAQ_EDIT permission to upload SVG files containing deeply nested ampersand encoding around numeric HTML entities. This flaw can be exploited to reconstruct 'javascript:' URLs, which, when clicked by other users, execute arbitrary JavaScript code and potentially compromise user sessions or data.

Affected Version(s)

phpmyfaq 0 < 4.1.2

phpmyfaq 4.1.2

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-stored-xss-...
third-party-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

offset
.