{"id":"CVE-2026-111903","kind":"vulnerability","aliases":["CVE-2026-111903"],"related":[],"title":"phpMyFAQ: SVG sanitizer bypass lets editors plant clickable script","description":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta has a stored cross-site scripting flaw in its SvgSanitizer, which fails to strip XML DTD custom entities. A user with FAQ edit permission can upload an SVG whose entity expands to a javascript link, so clicking it runs script in a viewer's browser and can hijack an admin session.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed phpMyFAQ version in the admin panel or `composer show phpmyfaq/phpmyfaq` and see whether it is in the 4.2.0-alpha to pre-4.2.0-beta range\n- Search uploaded attachments for SVG files containing `<!DOCTYPE` or `<!ENTITY`","fix":"- Upgrade phpMyFAQ to `4.2.0-beta` or later\n- Until upgraded, restrict FAQ_EDIT permission to trusted users and remove any existing SVG uploads that contain DTD entities","status":"open","published_at":"2026-10-17T19:16:32+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:16:59+00:00","updated_at":"2026-10-25T04:16:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:16:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.2.0-beta` or later\n- Until upgraded, restrict FAQ_EDIT permission to trusted users and remove any existing SVG uploads that contain DTD entities","reach":"internet","title":"phpMyFAQ: SVG sanitizer bypass lets editors plant clickable script","impact":"medium","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta has a stored cross-site scripting flaw in its SvgSanitizer, which fails to strip XML DTD custom entities. A user with FAQ edit permission can upload an SVG whose entity expands to a javascript link, so clicking it runs script in a viewer's browser and can hijack an admin session.","category":"package","nicknames":[],"who_cares":["phpmyfaq","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Script runs in admin browser, hijacking sessions","analyst_note":"","how_to_check":"- Check the installed phpMyFAQ version in the admin panel or `composer show phpmyfaq/phpmyfaq` and see whether it is in the 4.2.0-alpha to pre-4.2.0-beta range\n- Search uploaded attachments for SVG files containing `<!DOCTYPE` or `<!ENTITY`","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Sites running phpMyFAQ 4.2.0-alpha before 4.2.0-beta that let some users edit FAQs and upload SVG images. Exposure needs a user with edit rights to submit the file, and then a viewer to click the link. Installations on 4.2.0-beta or later, or with no SVG upload path for editors, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":3374,"output_tokens":654,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111903':12A,15A '-2026':11A,14A '4.2.0':23B,26B,81C,84C 'admin':78B,135C 'allow':97C 'alpha':24B,82C 'anchor':125C 'attack':111C 'beta':27B,85C 'browser':73B 'bypass':4A,104C 'click':65B,131C 'clickabl':8A 'contain':86C 'cross':32B,90C 'cross-sit':31B,89C 'custom':45B,109C 'cve':10A,13A 'defin':116C 'dtd':44B,108C 'edit':51B,101C 'editor':6A 'entiti':46B,58B,110C,118C 'execut':127C 'expand':59B,120C 'fail':40B 'faq':50B,100C 'flaw':35B 'hijack':76B,134C 'host':21B 'href':126C 'javascript':62B,122C 'let':5A 'link':63B 'packag':16B 'permiss':52B,102C 'php':17B 'phpmyfaq':1A,18B,22B,80C 'plant':7A 'run':67B 'sanit':3A,105C 'script':9A,34B,68B,92C,128C 'self':20B 'self-host':19B 'session':79B,136C 'site':33B,91C 'store':30B,88C 'strip':42B 'svg':2A,56B,115C 'svgsanit':38B,95C 'upload':54B,113C 'use':106C 'user':48B,98C 'viewer':71B,130C 'vulner':93C 'whose':57B 'xml':43B,107C","nicknames":[],"mitigations":[],"who_affected":"Sites running phpMyFAQ 4.2.0-alpha before 4.2.0-beta that let some users edit FAQs and upload SVG images. Exposure needs a user with edit rights to submit the file, and then a viewer to click the link. Installations on 4.2.0-beta or later, or with no SVG upload path for editors, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111903","severity":null,"published_at":"2026-10-17T19:16:32+00:00","modified_at":"2026-10-19T22:17:04+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}