EUVD-2026-30597
GHSA-wj3q-vw2v-3rj3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.
AnalysisAI
Authenticated users with FAQ_EDIT permission in phpMyFAQ can bypass SVG sanitization and execute arbitrary JavaScript in victims' browsers by exploiting recursive entity decoding limits. By nesting ampersand encoding five levels deep around numeric HTML entities in SVG href attributes (e.g., j for 'j'), attackers reconstruct javascript: URLs that the decodeAllEntities() method fails to detect but browsers fully decode. The malicious SVG uploads persist on the server and execute JavaScript when other users click the embedded links. Fixed in version 4.1.2. EPSS and KEV data not available; VulnCheck reported this issue with vendor-confirmed details and proof-of-concept in GitHub security advisory GHSA-whqh-9pq5-c7r3.
Technical ContextAI
phpMyFAQ is an open-source FAQ management system written in PHP. This vulnerability resides in the SvgSanitizer class, specifically the decodeAllEntities() helper method at phpmyfaq/src/phpMyFAQ/Helper/SvgSanitizer.php lines 223-249. The method performs iterative entity decoding to normalize SVG content before applying pattern matching for dangerous constructs like javascript: URLs in href attributes. The implementation limits recursive decoding to 5 iterations, where each iteration resolves numeric entities (&#NNN;), hexadecimal entities (&#xHH;), and one level of & via html_entity_decode(). The vulnerability exploits the mathematical relationship between nesting depth and iteration count: with 5 levels of & wrapping around numeric entities representing 'javascript', all 5 iterations are consumed unwinding the ampersand nesting, leaving the final numeric entities (j for 'j', a for 'a', etc.) unresolved. The isSafe() validation method at line 114 then applies regex pattern /href\s*=\s*["'][\s]*javascript\s*:/i to the partially decoded content, which does not match the numeric entity representation. Since isSafe() returns true, the malicious SVG bypasses sanitization entirely and is stored directly in content/user/images/. When served with image/svg+xml MIME type, the browser's native XML parser completes the entity decoding, reconstructing the javascript: URL. This is a classic instance of CWE-79 (Cross-site Scripting) caused by insufficient input validation and normalization depth mismatch between server-side sanitization and client-side rendering engines.
RemediationAI
Upgrade to phpMyFAQ version 4.1.2 or later, which fixes the vulnerability by increasing the maxIterations limit in decodeAllEntities() or implementing multi-phase entity normalization that fully resolves nested encoding before pattern matching. The fixed versions are available via Composer (composer/phpmyfaq/phpmyfaq:4.1.2 and composer/thorsten/phpmyfaq:4.1.2) and from the official GitHub repository at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-whqh-9pq5-c7r3. If immediate upgrade is not feasible, implement compensating controls with the following trade-offs: (1) Disable SVG upload functionality entirely by removing 'svg' from allowed file extensions in ImageController-this eliminates the attack vector but removes legitimate SVG support for FAQ illustrations; (2) Restrict FAQ_EDIT permission to only highly trusted administrators and implement multi-person approval workflows for content changes-this reduces the attacker pool but does not prevent exploitation if a trusted account is compromised; (3) Implement Content Security Policy headers with script-src 'self' and object-src 'none' to block inline javascript: execution-this provides defense-in-depth but may have compatibility issues with existing phpMyFAQ features that rely on inline scripts; (4) Serve user-uploaded files from a separate origin (sandbox domain) with strict CORS policies-this prevents XSS from accessing phpMyFAQ session cookies but requires infrastructure changes and CDN/storage reconfiguration. Note that workarounds (2), (3), and (4) do not fix the underlying sanitization flaw and should be considered temporary mitigations only. Official vendor patch in 4.1.2 is the definitive remediation.
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated high severity (CVSS 8.8), th
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today