Live › vulnerability › CVE-2026-111903
Go to dashboardphpMyFAQ 4.2.0-alpha before 4.2.0-beta has a stored cross-site scripting flaw in its SvgSanitizer, which fails to strip XML DTD custom entities. A user with FAQ edit permission can upload an SVG whose entity expands to a javascript link, so clicking it runs script in a viewer's browser and can hijack an admin session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running phpMyFAQ 4.2.0-alpha before 4.2.0-beta that let some users edit FAQs and upload SVG images. Exposure needs a user with edit rights to submit the file, and then a viewer to click the link. Installations on 4.2.0-beta or later, or with no SVG upload path for editors, can skip it.
No product ranges from the sources yet.
composer show phpmyfaq/phpmyfaq and see whether it is in the 4.2.0-alpha to pre-4.2.0-beta range<!DOCTYPE or <!ENTITY4.2.0-beta or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-111903")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.