EUVD-2026-30598
GHSA-h36g-93qx-rxgr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags via question or answer parameters, which execute in every visitor's browser when FAQ content is rendered with the raw Twig filter.
AnalysisAI
Stored cross-site scripting in phpMyFAQ versions prior to 4.1.2 allows authenticated users with FAQ_ADD permission to inject malicious JavaScript into FAQ questions and answers that execute in all visitors' browsers. The vulnerability exploits an encode-decode cycle where FILTER_SANITIZE_SPECIAL_CHARS encoding is immediately reversed by html_entity_decode(), bypassing Filter::removeAttributes() which only strips HTML attributes but not tags like <script>. Twig templates render this content with the |raw filter, executing stored payloads. CVSS 5.4 indicates network-accessible attack requiring low-privilege authentication and user interaction, with changed scope enabling cross-user impact. EPSS data not provided; no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
Technical ContextAI
phpMyFAQ is a PHP-based FAQ management system using Twig templating. This CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability stems from a flawed sanitization architecture in FaqController.php. The code applies htmlspecialchars() via FILTER_SANITIZE_SPECIAL_CHARS to convert angle brackets to HTML entities, then immediately calls html_entity_decode() to reverse the encoding before passing content to Filter::removeAttributes(). This attribute-stripping function uses regex patterns to remove event handlers and style attributes but performs no tag-level validation, allowing <script>, <iframe>, <object>, and <embed> tags to persist. The stored payloads are rendered through faq.twig and search.twig templates using Twig's |raw filter, which explicitly disables auto-escaping. Affected CPE is cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:* for versions ≤4.1.1. Both Composer package names (composer/phpmyfaq and thorsten/phpmyfaq) are affected, suggesting namespace migration in the project's history.
RemediationAI
Upgrade to phpMyFAQ version 4.1.2 immediately, which addresses the encode-decode bypass and implements proper tag-level sanitization. For Composer-managed installations, run 'composer require thorsten/phpmyfaq:^4.1.2' or 'composer update thorsten/phpmyfaq' depending on package naming in composer.json. Verify the fix by checking FaqController.php no longer calls html_entity_decode() before sanitization, or that Filter::removeAttributes() has been replaced with proper HTML tag filtering (exact fix implementation not detailed in advisory). If immediate patching is not feasible, implement compensating controls with the following trade-offs: (1) Revoke FAQ_ADD permission from all users except a single trusted administrator account until patching is complete - this eliminates the PR:L attack vector but may disrupt FAQ management workflows in organizations with distributed content editors, (2) Remove the |raw filter from faq.twig and search.twig templates and replace with Twig's default auto-escaping - this prevents JavaScript execution but will cause existing FAQ content containing legitimate HTML formatting to display as escaped entities, breaking intended formatting, (3) Implement Web Application Firewall rules to block <script>, <iframe>, <object>, and <embed> tags in POST requests to /admin/api/faq/create and /admin/api/faq/update endpoints - effective but may be bypassed by encoding variations or other dangerous tags not in the blocklist. Full remediation guidance at GitHub advisory https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f5p7-2c9q-8896.
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated high severity (CVSS 8.8), th
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today