phpMyFAQ CVE-2026-111896

Requires an authenticated account with FAQ-editor privileges capable of uploading SVG files (PR:L), and exploitation only triggers when a victim subsequently opens the stored SVG (UI:P / passive interaction). The specific technical prerequisite is the flawed single-pass SvgSanitizer: an attacker splits a script tag around removed tokens such as XML processing instructions so that removal reassembles executable markup. Limiting factors: only affects phpMyFAQ 4.2.0-alpha up to (not including) 4.2.0-beta, the attacker must already hold editor-level access, no automatic execution occurs without a victim viewing the file, and impact is confined to the application origin.

This is a medium-severity, genuinely medium-real-risk issue rather than a top-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N with SC:L/SI:L) scores 5.1 and describes a stored XSS requiring an authenticated FAQ-editor account (PR:L) plus a victim passively opening the malicious SVG (UI:P) - two gating conditions that meaningfully reduce mass-exploitability. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided in the input, so there is no positive signal of active or imminent exploitation; the absence of these signals is consistent with a low-urgency, insider-or-social-engineering-dependent bug rather than a wormable flaw. The technical impact is partial (C:L/I:L) and limited to script execution in the application origin against users who view the uploaded file. SSVC-style framing: exploitation = none observed, automatable = no (requires authored content plus victim interaction), technical impact = partial. No conflicting signals were found - the network vector is consistent with a web application and the PR:L/UI:P metrics align with the 'FAQ editors store SVG, victims open it' description.

A user with FAQ-editor privileges crafts a malicious SVG in which script tags are split around tokens such as XML processing instructions, uploads it, and the SvgSanitizer's single-pass removal strips the intervening token and reassembles a working <script> element. When another user (e.g., a reader or administrator) opens the stored SVG, the script executes in the phpMyFAQ application origin, enabling session theft or actions in the victim's context. No public exploit code was identified at time of analysis, though the reassembly technique is described in detail in the advisory.