EUVD-2026-86010
GHSA-pgwp-vc7q-cvj3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit malicious FAQ entry as unauthenticated user
-
DeliveryEntity-encoded payload bypasses strip_tags()
-
ExploitAdmin opens submission for review
-
Executionhtml_entity_decode()+Twig |raw renders script
-
PersistJavaScript executes in admin session
-
ImpactSteal session and take over admin account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the phpMyFAQ instance (versions prior to 4.2.0-alpha) accept user-submitted FAQ entries - the default community-submission workflow. Exploitation is unauthenticated to plant the payload (PR:N), but it only triggers when an administrator subsequently reviews or edits the submitted entry in the admin panel (UI:R), so success depends on admin interaction with attacker-controlled content. The flaw is inherent to the code path (strip_tags → html_entity_decode → Twig |raw rendering without output sanitization) and does not require any non-default configuration. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N = 8.2 High) is internally consistent with the description: a network-reachable web app where an unauthenticated user (PR:N) submits a malicious FAQ entry that fires only when an administrator later reviews or edits it (UI:R), crossing a privilege boundary into the admin session (S:C). The C:H reflects that the payload steals the admin session and yields account takeover; I:L/A:N is reasonable since impact is primarily confidentiality/session-driven rather than direct data destruction. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no signal of active or automated exploitation - this is a plausible-but-unproven risk rather than a confirmed campaign. The dependency on an administrator opening attacker-controlled content (UI:R) is a genuine limiting factor that lowers real-world likelihood below what the 8.2 base score alone implies; it is a targeted social-vector bug, not a wormable pre-auth RCE. Overall: a legitimately serious stored-XSS-to-admin-takeover worth patching promptly for exposed instances, but no evidence it is being weaponized at scale. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a public FAQ entry containing HTML-entity-encoded JavaScript that survives strip_tags() and is later decoded by html_entity_decode() and rendered via Twig's |raw filter. When an administrator opens the submission to review or edit it, the script executes in the admin's authenticated browser context, exfiltrating the session and enabling full account takeover. No public exploit code was identified at time of analysis, though the GitHub Security Advisory documents the exact code-flow flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Stored cross-site scripting in phpMyFAQ versions prior to 4.2.0-alpha allows unauthenticated remote attackers, as well as low-privileged registered users, to plant arbitrary JavaScript in user-submitted FAQ entries that executes in an administrator's browser when the entry is reviewed or edited, enabling admin session theft and full account takeover. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, 8.2 High) reflects that no authentication is needed to submit the payload, but exploitation succeeds only when an administrator later interacts with the attacker-controlled content; the scope change indicates the compromise crosses from the unauthenticated submitter into the privileged admin session. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE, though the default community-submission workflow in affected releases makes the attack path straightforward once a target is identified.
RemediationAI
The vendor has released the fix in phpMyFAQ 4.2.0-alpha (Vendor-released patch: 4.2.0-alpha); upgrading to that version or any later release removes the vulnerable strip_tags/html_entity_decode/|raw sequence and is the only complete remediation. The advisory at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgwp-vc7q-cvj3 should be consulted for the precise commit and upgrade notes. Where immediate upgrading is not possible, the highest-value compensating control is to disable the community user-submission feature entirely, which removes the injection vector but sacrifices the FAQ contribution workflow; alternatively, restrict submission privileges to a tightly controlled set of trusted accounts, which lowers but does not eliminate risk because a low-privileged user can still plant the payload. Deploying a web application firewall or reverse-proxy rule that blocks script-bearing markup in submission POST bodies provides interim protection but risks false positives against legitimate content and must be validated against the application's form encoding. Administrators should also be advised not to open unreviewed user-submitted entries until the patch is applied, since the payload fires on review, and existing pending or published entries should be audited and re-sanitized after upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., cross-site scripting) arising from an ordering flaw in phpMyFAQ's sanitization pipeline. The application calls strip_tags() on submitted FAQ content first, which is intended to remove HTML tags, but then passes the result through html_entity_decode(), which converts HTML entities back into their literal character forms. Any entity-encoded markup that survived strip_tags() as inert text is therefore reconstituted as executable HTML before storage or rendering. The admin-side template subsequently outputs the content using Twig's |raw filter, which explicitly disables Twig's contextual autoescaping, so the decoded markup is delivered to the administrator's browser without any output sanitization. The CPE record cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:* identifies the affected package as Thorsten Rinne's phpMyFAQ across all versions before the 4.2.0-alpha fix, and the sole reference is the project's GitHub security advisory GHSA-pgwp-vc7q-cvj3, which corresponds to the reported repository changes. Because the vulnerable path is reached through the standard user-submission feature rather than a non-default configuration, any deployment that accepts community FAQ entries is exposed.
Know when Phpmyfaq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Unauthenticated network submission (PR:N/AV:N), but requires admin to view the entry (UI:R); XSS executing in admin session crosses privilege boundary (S:C) yielding session theft/account takeover (C:H, I:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft. The vulnerability exists because html_entity_decode() converts HTML entities into executable HTML after strip_tags() has already passed them through, and the admin template renders the content with Twig's |raw filter without any output sanitization. Version 4.2.0-alpha fixes the issue.
Technical POC Analysis
Stored XSS (CWE-79) in phpMyFAQ's frontend FAQ submission API.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
phpMyFAQ installations running versions prior to 4.2.0-alpha are exposed to a stored cross-site scripting flaw that lets an unauthenticated outsider plant malicious script inside community-submitted FAQ entries, which then executes in the browser of any administrator who reviews or edits that content. The practical consequence for the organization is administrative account takeover on the affected knowledge-base platform, giving an attacker the same access as the site owner and creating a credible path to further compromise of internal systems and data. Leadership should care because the platform is internet-facing and the submission workflow that enables the attack is on by default, so exposure is broad rather than limited to a niche configuration.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or restrict public FAQ submission and self-registration; require administrator moderation and pre-storage sanitization of all submitted content; deploy WAF/reverse-proxy filtering of script tags and event handlers on submission endpoints; enforce a restrictive Content-Security-Policy on the admin interface; rotate administrator credentials and invalidate active admin sessions; restrict admin-console access to trusted networks or VPN; audit and clean stored FAQ entries for injected script; monitor for anomalous admin session activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Duplicate-email registration handling in phpMyFAQ 4.0.7 through 4.0.13 (and 4.0-nightly-2025-10-03 and earlier) lets una
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Exploit-DB