PT-2026-41362 · Phpmyfaq · Phpmyfaq

Offset · Published 2026-05-06 · Updated 2026-05-15 · CVE-2026-46360

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.2

Description A stored cross-site scripting issue exists in the decodeAllEntities() function of the SvgSanitizer class. The function limits recursive entity decoding to 5 iterations, which allows the sanitization process to be bypassed. Authenticated users with FAQ EDIT permission can upload malicious SVG files containing deeply nested ampersand encoding around numeric HTML entities. This technique reconstructs javascript: URLs, leading to the execution of arbitrary JavaScript when other users view the uploaded SVG file.

Recommendations Update to version 4.1.2 or later. As a temporary mitigation, restrict the FAQ EDIT permission to trusted users only.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-46360

GHSA-WHQH-9PQ5-C7R3

GHSA-WJ3Q-VW2V-3RJ3

Affected Products

Phpmyfaq

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46360.json · Exploit
• 🔥 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-whqh-9pq5-c7r3 · Exploit
• https://osv.dev/vulnerability/GHSA-whqh-9pq5-c7r3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46360 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wj3q-vw2v-3rj3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46360 · Security Note
• https://github.com/thorsten/phpMyFAQ · Note
• https://vulncheck.com/advisories/phpmyfaq-stored-xss-via-entity-decoding-depth-limit-bypass-in-svg-sanitizer · Note