CVE-2026-46367: phpMyFAQ Stored XSS Vulnerability via Utils::parseUrl() in Comment Rendering
Summary
CVE-2026-46367: phpMyFAQ: Stored XSS via Utils::parseUrl() in comment rendering. Affects phpMyFAQ/phpMyFAQ versions < 4.1.2. Fixed in 4.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyFAQ is an open-source FAQ management system that allows users to create and manage frequently asked questions. It is widely used for its ease of use and flexibility. However, prior to version 4.1.2, phpMyFAQ contained a vulnerability that allowed authenticated users to exploit the comment rendering feature, leading to potential security breaches.
Vulnerability Detail
The vulnerability arises from a stored cross-site scripting (XSS) flaw in the Utils::parseUrl() function. This issue allows authenticated users to inject malicious JavaScript code through malformed URLs in comments. When other users view the affected FAQ pages, the injected scripts can execute, potentially stealing session cookies and allowing attackers to take over admin accounts.
How To Fix
Minimum fixed version
4.1.2
This is the first release that contains the fix.
composer require phpMyFAQ/phpMyFAQ:4.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs in comments to prevent the injection of malicious scripts. This can be done by escaping quotes and other special characters in URLs before they are processed by the Utils::parseUrl() function.
Conclusion
In summary, CVE-2026-46367 is a critical stored XSS vulnerability in phpMyFAQ that can lead to severe security issues if not addressed. Users are strongly encouraged to update to version 4.1.2 or later to protect their applications from potential exploitation.
See every vulnerability recorded for phpMyFAQ/phpMyFAQ →
FAQ
The vulnerability allows attackers to execute JavaScript in the context of the user's session, potentially leading to session hijacking and full application takeover.
Authenticated users of phpMyFAQ versions prior to 4.1.2 are at risk, especially those who can post comments.
You can use Vulert's playground at Vulert Scanner to check for vulnerabilities in your application without needing to sign up.
The CVSS score for this vulnerability is 7.6, indicating a high severity level.
If immediate updates are not possible, implement input sanitization as a temporary measure to mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for phpMyFAQ/phpMyFAQ.
