CVE-2026-111903 in phpMyFAQ
Summary
by MITRE • 10/17/2026
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The identified vulnerability resides within the SvgSanitizer component of phpMyFAQ versions prior to 4.2.0-beta, specifically affecting releases from version 4.2.0-alpha up to but not including the beta release. This flaw represents a stored cross-site scripting (XSS) issue that arises due to insufficient validation and sanitization of SVG content uploaded by users who possess FAQ_EDIT permissions. The core technical failure lies in the application's handling of XML Document Type Definitions within SVG files, where attackers can define custom entities designed to expand into malicious JavaScript code when processed or rendered by a victim user's browser.
The exploitation mechanism relies on the attacker uploading an SVG file that contains a specifically crafted DTD section defining a custom entity. This entity is structured such that its expansion results in valid HTML anchor tags with javascript: URIs embedded within their href attributes. Because phpMyFAQ stores this content for later retrieval and display, the malicious payload persists on the server side rather than being transient as seen in reflected XSS attacks. When an administrator or another authorized user views a FAQ entry containing this compromised SVG, the browser parses the SVG and processes the DTD entity expansion. This process effectively bypasses standard sanitization filters that may have been intended to block script execution vectors, allowing arbitrary JavaScript code to execute within the context of the victim's authenticated session.
The operational impact of this vulnerability is significant due to its stored nature and the privilege level required for exploitation. Since only users with FAQ_EDIT permission are needed to trigger the initial upload, a broader range of internal actors can potentially introduce the payload. However, the critical execution phase requires interaction from higher-privileged users who view the content. Successful exploitation allows an attacker to hijack administrative sessions by stealing session cookies or tokens, performing actions on behalf of the administrator, exfiltrating sensitive data stored within the FAQ system, or defacing the application interface. This undermines the integrity and confidentiality guarantees provided by the authentication and authorization mechanisms of phpMyFAQ.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it illustrates a case where input validation fails to account for complex parsing behaviors such as XML entity expansion within SVG contexts. In terms of the MITRE ATT&CK framework, this behavior maps to T1059 Command and Control via Application Layer Protocol or more broadly to Execution techniques involving browser-based script injection. The stored aspect also correlates with persistence mechanisms where malicious content is embedded in legitimate data streams for later execution.
Mitigation strategies should prioritize immediate upgrading to phpMyFAQ version 4.2.0-beta or any subsequent stable release that addresses this specific sanitization flaw. Until an update can be applied, administrators should restrict FAQ_EDIT permissions to only those users who absolutely require them, thereby reducing the attack surface available for uploading malicious SVGs. Additionally, implementing a Content Security Policy (CSP) with strict directives regarding script execution and object sources can help mitigate the impact of successful XSS attempts by preventing inline scripts from running or restricting where resources are loaded from. Input validation should also be enhanced to explicitly reject SVG files containing DTD sections or custom entity definitions that could lead to code expansion, ensuring that only safe subsets of SVG markup are permitted for storage and rendering.