---
id: "CVE-2026-111903"
kind: "vulnerability"
aliases: ["CVE-2026-111903"]
title: "phpMyFAQ: SVG sanitizer bypass lets editors plant clickable script"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "phpmyfaq", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-17T19:16:32+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:16:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111903", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# phpMyFAQ: SVG sanitizer bypass lets editors plant clickable script

phpMyFAQ 4.2.0-alpha before 4.2.0-beta has a stored cross-site scripting flaw in its SvgSanitizer, which fails to strip XML DTD custom entities. A user with FAQ edit permission can upload an SVG whose entity expands to a javascript link, so clicking it runs script in a viewer's browser and can hijack an admin session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed phpMyFAQ version in the admin panel or `composer show phpmyfaq/phpmyfaq` and see whether it is in the 4.2.0-alpha to pre-4.2.0-beta range
- Search uploaded attachments for SVG files containing `<!DOCTYPE` or `<!ENTITY`

## Fix

- Upgrade phpMyFAQ to `4.2.0-beta` or later
- Until upgraded, restrict FAQ_EDIT permission to trusted users and remove any existing SVG uploads that contain DTD entities

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111903

## From the sources

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_