{"id":"CVE-2026-111894","kind":"vulnerability","aliases":["CVE-2026-111894"],"related":[],"title":"phpMyFAQ: stored XSS via data:text/html iframes in FAQ and news","description":"phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.","summary":"Authenticated content authors can embed iframes with data:text/html sources in FAQ or news entries, and the sanitizer fails to block them. Viewers' browsers then run attacker JavaScript for phishing or top-frame redirects.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed version with `phpMyFAQ` admin panel or `composer show phpmyfaq/phpmyfaq` (unknown if the sources give a file to read)\n- Look for FAQ or news entries containing `<iframe` with `data:text/html` in the source","fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line, or to `4.2.0-beta` or later on the 4.2 line\n- Unknown whether a workaround exists short of upgrading","status":"open","published_at":"2026-10-17T19:16:31+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:18:13+00:00","updated_at":"2026-10-25T04:18:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:18:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line, or to `4.2.0-beta` or later on the 4.2 line\n- Unknown whether a workaround exists short of upgrading","reach":"internet","title":"phpMyFAQ: stored XSS via data:text/html iframes in FAQ and news","impact":"medium","summary":"Authenticated content authors can embed iframes with data:text/html sources in FAQ or news entries, and the sanitizer fails to block them. Viewers' browsers then run attacker JavaScript for phishing or top-frame redirects.","category":"package","nicknames":[],"who_cares":["phpmyfaq","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Viewers' browsers run attacker script for phishing or redirects","analyst_note":"","how_to_check":"- Check the installed version with `phpMyFAQ` admin panel or `composer show phpmyfaq/phpmyfaq` (unknown if the sources give a file to read)\n- Look for FAQ or news entries containing `<iframe` with `data:text/html` in the source","needs_analyst":false,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Sites running phpMyFAQ 3.2.1 through 4.1.8, or 4.2.0-alpha builds before 4.2.0-beta, where content authors can post FAQ or news entries. Exposure depends on who holds author rights; sites where only trusted staff write content carry less risk. Sites on a fixed version can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3418,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111894':14A,17A '-2026':13A,16A '3.2.1':60C '4.1.9':62C '4.2.0':64C,67C 'allow':78C 'allowlist':105C 'alpha':65C 'attack':50B,97C 'authent':24B,79C 'author':26B,81C 'beta':68C 'block':44B 'browser':47B 'bypass':99C 'cleanupcont':108C 'contain':69C 'content':25B,80C,96C 'cross':73C 'cross-sit':72C 'cve':12A,15A 'data':5A,31B,89C 'emb':28B 'embed':86C 'entri':38B 'fail':42B 'faq':9A,35B,93C 'faqhelp':107C 'filter':116C 'frame':57B,124C 'host':23B,104C 'hostless':101C 'ifram':7A,29B,87C 'inject':83C 'interfac':120C 'javascript':51B,84C 'media':103C 'media-host':102C 'news':11A,37B,95C 'packag':18B 'phish':53B,119C 'php':19B 'phpmyfaq':1A,20B,59C 'raw':115C 'redirect':58B,125C 'render':111C 'run':49B,118C 'sanit':41B 'script':75C 'self':22B 'self-host':21B 'site':74C 'sourc':33B,91C 'store':2A,71C 'text/html':6A,32B,90C 'top':56B,123C 'top-fram':55B,122C 'twig':113C 'via':4A,112C 'viewer':46B,127C 'vulner':76C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Sites running phpMyFAQ 3.2.1 through 4.1.8, or 4.2.0-alpha builds before 4.2.0-beta, where content authors can post FAQ or news entries. Exposure depends on who holds author rights; sites where only trusted staff write content carry less risk. Sites on a fixed version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111894","severity":null,"published_at":"2026-10-17T19:16:31+00:00","modified_at":"2026-10-21T22:16:47+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}