PT-2026-29785 · Phpmyfaq · Phpmyfaq

0Xmanhnv · Published 2026-04-01 · Updated 2026-04-02 · CVE-2026-34974

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.1

Description pMyFAQ, an open source FAQ web application, contains a flaw in its SVG sanitizer (SvgSanitizer.php). The regex-based sanitization can be bypassed by using HTML entity encoding within javascript: URLs inside SVG <a href> attributes. A user with edit faq permission can upload a malicious SVG file that executes arbitrary JavaScript when viewed. This allows for privilege escalation from an editor to a full admin takeover. The vulnerable file, phpmyfaq/src/phpMyFAQ/Helper/SvgSanitizer.php, uses a regex pattern that fails to detect HTML entity encoded javascript: URLs. The vulnerability is exploitable through the image upload endpoint /admin/api/content/images which requires only edit faq permission. The uploaded SVG files are served with Content-Type: image/svg+xml without a Content-Disposition: attachment header, enabling inline rendering and JavaScript execution.

Recommendations Update phpMyFAQ to version 4.1.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34974

GHSA-5CRX-PFHQ-4HGG

Affected Products

Phpmyfaq

References · 7

• 🔥 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-5crx-pfhq-4hgg · Exploit
• https://osv.dev/vulnerability/GHSA-5crx-pfhq-4hgg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34974 · Security Note
• https://github.com/thorsten/phpMyFAQ · Note
• https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1 · Note
• https://twitter.com/VulmonFeeds/status/2039749123054653769 · Twitter Post
• https://twitter.com/CVEnew/status/2039744289320603841 · Twitter Post