Live › vulnerability › CVE-2026-111896
Go to dashboardphpMyFAQ's SvgSanitizer removes tokens in a single pass, so split script tags get reassembled after removal and survive. An FAQ editor can upload an SVG that executes script in the application's origin when a victim opens it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations of phpMyFAQ from 4.2.0-alpha before 4.2.0-beta that let FAQ editors upload SVG files are exposed. The sources do not say whether default configurations accept SVG uploads. Sites on other phpMyFAQ versions can skip it.
No product ranges from the sources yet.
4.2.0-alpha through 4.2.0-beta (before 4.2.0-beta) is affected.4.2.0-beta or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.
This page as .md · .json · in your agent: get_signal("CVE-2026-111896")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.