PT-2026-29423 · Phpmyfaq · Phpmyfaq

Wooseokdotkim · Published 2026-03-31 · Updated 2026-04-02 · CVE-2026-32629

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.1

Description prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address containing raw HTML that is accepted as valid by PHP's FILTER VALIDATE EMAIL function. This email is stored in the database without sanitization and rendered in the admin FAQ editor template using Twig's |raw filter, bypassing auto-escaping. This allows for the execution of arbitrary scripts in the administrator's browser when reviewing the FAQ, potentially leading to session cookie theft and full admin account takeover.

Recommendations Update to version 4.1.1 or later.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

CVE-2026-32629

GHSA-98GW-W575-H2PH

Affected Products

Phpmyfaq

References · 6

• 🔥 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98gw-w575-h2ph · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32629 · Security Note
• https://osv.dev/vulnerability/GHSA-98gw-w575-h2ph · Vendor Advisory
• https://github.com/thorsten/phpMyFAQ · Note
• https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1 · Note
• https://twitter.com/CVEnew/status/2039744330907226161 · Twitter Post