phpMyFAQ EUVD-2026-103317

Exploitation requires an authenticated account with the FAQ_EDIT permission (PR:L) and the ability to upload SVG files; the attacker crafts an SVG that uses an XML DTD custom entity expanding to a javascript: URI in an anchor href to bypass the SvgSanitizer component. Script execution does NOT occur on upload - it requires a victim (typically an admin) to actively view the FAQ and click the malicious anchor link (UI:P), which is the primary limiting factor. The flaw is confined to phpMyFAQ 4.2.0-alpha releases before 4.2.0-beta, so only instances running that pre-release branch are affected; stable/other-version deployments are not.

This is a moderate-severity, authenticated stored XSS (CVSS 4.0 base 5.1, CWE-79) that realistically sits below the top of any patch queue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) agrees with the description: network-reachable but gated behind an account holding FAQ_EDIT permission (PR:L = authenticated) and dependent on a victim interacting with the malicious content (UI:P). No EPSS score was provided, so exploitation probability cannot be quantified; the CVE is not listed in CISA KEV and no POC or exploit code is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent - there is no CVSS-vs-description conflict here - but the combined requirement of an existing privileged (FAQ_EDIT) account plus victim click action meaningfully lowers real-world risk versus the raw 'network' attack vector. Primary realistic threat model is a malicious or compromised low-privilege editor escalating to an admin by hijacking an admin session, i.e. a privilege-escalation/insider or post-compromise vector rather than mass remote exploitation.

An attacker who already holds a FAQ_EDIT account uploads an SVG whose XML DTD defines a custom entity that expands to a javascript: URI inside an anchor href, bypassing SvgSanitizer. When an administrator later views the FAQ content and clicks the crafted link, the script executes in the admin's browser session, enabling session hijacking. No public exploit code is referenced, so exploitation would currently require independent development from the advisory details.