Which versions of phpMyFAQ are affected by CVE-2026-46367?

phpMyFAQ 4.1.1 contains a vulnerability allowing registered users to inject malicious code into comments that executes for all site visitors including administrators.. A patch is available.

How to fix or mitigate CVE-2026-46367?

24 hours: Identify all phpMyFAQ deployments and versions currently in use, particularly 4.1.1 instances. 7 days: Apply available vendor patch to all affected phpMyFAQ 4.1.1 installations per vendor advisory. 30 days: Verify complete patching across all systems and audit user access controls for comment submission capabilities.

phpMyFAQ CVE-2026-46367

Q: What is the CVSS score of CVE-2026-46367?

CVE-2026-46367 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30578 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-15 VulnCheck

GHSA-w42g-jj8w-fj77

GHSA-9525-27vj-c8r8

XSS Phpmyfaq

8.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

May 28, 2026 - 16:38 vuln.today

v3 (cvss_changed)

Analysis Updated

May 28, 2026 - 16:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 28, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 28, 2026 - 16:22 NVD

7.6 (HIGH) 8.3 (HIGH)

Patch available

May 15, 2026 - 20:02 EUVD

Source Code Evidence Fetched

May 15, 2026 - 19:31 vuln.today

Analysis Generated

May 15, 2026 - 19:31 vuln.today

DescriptionCVE.org

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments. Attackers can craft URLs with unescaped quotes to inject event handlers, stealing admin session cookies and achieving full application takeover when visitors view affected FAQ pages.

AnalysisAI

Stored cross-site scripting in phpMyFAQ 4.1.1 lets any authenticated user with a registered account persist JavaScript inside FAQ or News comments by submitting a URL containing an unescaped double quote, which Utils::parseUrl() injects unescaped into an href attribute. Payloads execute for every visitor - including admins viewing the comments panel - enabling session cookie theft and full application takeover. Publicly available exploit code exists in the GHSA advisory, though EPSS is only 0.01% and SSVC categorizes exploitation as POC rather than active.

Technical ContextAI

The vulnerable sink is Utils::parseUrl() at phpmyfaq/src/phpMyFAQ/Utils.php line 281, which uses the regex /(https?:\/\/[^\s]+)/i and substitutes matches directly into <a href="$1">$1</a> with no htmlspecialchars() call - a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw where the character class [^\s]+ greedily consumes the literal double-quote needed to break out of the attribute. The sink is only reachable when main.enableCommentEditor is enabled, because that path routes comments through sanitizeHtmlComment() instead of FILTER_SANITIZE_SPECIAL_CHARS, preserving the quote through storage; rendering then uses {{ comment.comment|raw }} in comment.macros.twig line 40, disabling Twig auto-escaping. The CPE cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:* covers the affected upstream package, and the absence of any Content-Security-Policy header in the application removes a key mitigating control.

RemediationAI

Vendor-released patch: upgrade to phpMyFAQ 4.1.2 via Composer (thorsten/phpmyfaq or phpmyfaq/phpmyfaq), as documented in GHSA-9525-27vj-c8r8 at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9525-27vj-c8r8. If immediate upgrade is not possible, the highest-leverage workaround is to disable the rich comment editor by setting main.enableCommentEditor = false in the admin Configuration panel, which routes comment input back through FILTER_SANITIZE_SPECIAL_CHARS and prevents the double-quote from surviving to the parseUrl() sink - the trade-off is loss of HTML formatting in comments. As compensating controls, disable open user registration and remove existing low-trust accounts to eliminate the authenticated precondition, purge or moderate stored comments before applying the fix to remove any pre-planted payloads, and deploy a strict Content-Security-Policy header (the app currently sets none) such as default-src 'self'; script-src 'self' to neutralize inline event handlers, accepting that any inline scripts the app legitimately uses will need refactoring.