CVE-2026-46360: phpMyFAQ SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
Summary
CVE-2026-46360: phpMyFAQ: SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS. Affects phpMyFAQ/phpMyFAQ versions < 4.1.2. Fixed in 4.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyFAQ is an open-source FAQ management system that allows users to create and manage frequently asked questions. It is widely used for its user-friendly interface and extensive features, including support for multiple languages and customizable templates. However, like many web applications, it is susceptible to security vulnerabilities, particularly in its handling of user-uploaded content, such as SVG files.
Vulnerability Detail
The vulnerability in phpMyFAQ arises from the SvgSanitizer::decodeAllEntities() function, which limits recursive entity decoding to five iterations. This limitation can be exploited by authenticated users with FAQ_EDIT permission, allowing them to upload malicious SVG files. By using deeply nested ampersand encoding around numeric HTML entities, attackers can reconstruct 'javascript:' URLs that execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG. This leads to stored cross-site scripting (XSS), potentially compromising user data and application integrity.
How To Fix
Minimum fixed version
4.1.2
This is the first release that contains the fix.
composer require phpMyFAQ/phpMyFAQ:4.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the ability to upload SVG files to only trusted users or disable SVG uploads entirely until the package can be updated. Additionally, consider implementing additional server-side validation for uploaded files to prevent malicious content.
Conclusion
The CVE-2026-46360 vulnerability in phpMyFAQ poses a significant risk due to its potential for stored XSS attacks through malicious SVG uploads. It is crucial for users to update to version 4.1.2 or later to safeguard their applications. Implementing additional security measures can further mitigate risks associated with file uploads.
See every vulnerability recorded for phpMyFAQ/phpMyFAQ →
FAQ
CVE-2026-46360 is a vulnerability in phpMyFAQ that allows for stored cross-site scripting (XSS) through malicious SVG file uploads.
Authenticated users with FAQ_EDIT permission in phpMyFAQ versions prior to 4.1.2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can lead to the execution of arbitrary JavaScript in the context of other users, potentially compromising their data and the integrity of the application.
Mitigation can be achieved by updating to the latest version of phpMyFAQ and restricting SVG file uploads to trusted users.
Related vulnerabilities
Recent vulnerabilities recorded for phpMyFAQ/phpMyFAQ.
