Which versions of phpMyFAQ are affected by CVE-2026-46361?

phpMyFAQ versions before 4.1.2 contain a vulnerability that allows FAQ editors to inject malicious code, which executes for all users including system administrators.. A patch is available.

How to fix or mitigate CVE-2026-46361?

24 hours: Identify all phpMyFAQ instances, document versions, restrict FAQ editor role access, and reset administrator passwords. 7 days: Deploy phpMyFAQ 4.1.2 or later to all affected systems and verify functionality. 30 days: Audit historical FAQ content for injected scripts, review editor access logs, and conduct security awareness training for FAQ editors.

phpMyFAQ CVE-2026-46361

Q: What is the CVSS score of CVE-2026-46361?

CVE-2026-46361 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30596 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-15 VulnCheck

GHSA-478m-mrw4-qf2w

XSS PHP

8.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

May 28, 2026 - 16:41 vuln.today

v3 (cvss_changed)

Analysis Updated

May 28, 2026 - 16:39 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 28, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

May 28, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

May 28, 2026 - 16:22 NVD

6.9 (MEDIUM) 8.2 (HIGH)

Patch available

May 15, 2026 - 20:02 EUVD

Source Code Evidence Fetched

May 15, 2026 - 19:37 vuln.today

Analysis Generated

May 15, 2026 - 19:37 vuln.today

DescriptionCVE.org

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.

AnalysisAI

Stored cross-site scripting in phpMyFAQ before 4.1.2 lets FAQ editors persist HTML-entity-encoded JavaScript that survives sanitization and executes in every visitor's browser, including administrators. The flaw stems from Twig's | raw filter being applied to result.question and result.answerPreview in search.twig, combined with a html_entity_decode(strip_tags()) round-trip in SearchController.php that resurrects encoded tags. Publicly available exploit code exists (POC per SSVC), though EPSS is 0.01% and the issue is not on the CISA KEV list.

Technical ContextAI

phpMyFAQ is a PHP-based open-source FAQ management application maintained by Thorsten Rinne (CPE cpe:2.3:a:thorsten:phpmyfaq). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) and is two-fold: the Twig template engine's autoescape is unconditionally disabled by the | raw filter on multiple variables in search.twig, and the upstream sanitization in Search.php/SearchController.php performs html_entity_decode(strip_tags(...)), which strips tags first and then decodes HTML entities - re-materializing tags that an attacker encoded as <script>. This is distinct from the previously patched GHSA-cv2g-8cj8-vgc7 in faq.twig and was not resolved by the 4.1.1 release.

RemediationAI

Vendor-released patch: phpMyFAQ 4.1.2 - upgrade immediately via Composer (composer require thorsten/phpmyfaq:^4.1.2 or phpmyfaq/phpmyfaq:^4.1.2) per the GitHub advisory at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pqh6-8fxf-jx22. If patching cannot be performed immediately, restrict the FAQ editor/contributor role to fully trusted users and audit existing FAQ records and custom pages for HTML-entity-encoded payloads (search stored content for patterns like <script, <, onerror=, etc.). As a template-level workaround you can edit phpmyfaq/assets/templates/default/search.twig to remove the | raw filter from result.question and result.answerPreview (side effect: any legitimately HTML-formatted FAQ titles or previews will render as escaped text). A Content-Security-Policy header forbidding inline script (script-src 'self') provides defense-in-depth at the cost of breaking any inline JS the deployment relies on. Disabling the search feature entirely removes the vulnerable code path but eliminates a core user feature.