CVE-2026-85593 in phpMyFAQ
Summary
by MITRE • 09/04/2026
phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that execute in the browsers of all users viewing the affected FAQ pages.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The security flaw identified in phpMyFAQ versions prior to 4.1.8 represents a critical stored cross-site scripting vulnerability located within the FaqHelper::convertOldInternalLinks() function. This specific component is responsible for processing and rendering legacy internal links within frequently asked question entries. The core technical deficiency arises from an improper neutralization of special elements, specifically involving the application of html_entity_decode on content that has already undergone sanitization processes. By decoding HTML entities after they have been sanitized or in a context where such decoding reverses previous protective measures, the system inadvertently re-introduces executable script tags into the rendered output. This logical error effectively neutralizes the intended security controls designed to prevent malicious code injection, allowing raw JavaScript payloads to persist within the database and subsequently execute when accessed by users.
From an operational perspective, this vulnerability poses a severe risk due to its stored nature combined with broad user impact potential. While exploitation requires authenticated access with FAQ editing privileges, once a payload is injected into a question or answer entry, it becomes persistent in the system's data store. Consequently, every subsequent visitor who views the affected FAQ page will have their browser execute the malicious script without any further interaction required from them beyond loading the page. This mechanism facilitates session hijacking, credential theft via keylogging scripts, defacement of the website interface, or redirection to phishing sites. The widespread exposure means that a single compromised account with editing rights can lead to a mass compromise of all users accessing the public-facing knowledge base, significantly undermining user trust and data integrity.
In terms of industry standard classification, this vulnerability aligns closely with CWE-79, which defines Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The specific mechanism where encoding is reversed after sanitization highlights a failure in input validation logic rather than a simple lack of filtering. Furthermore, the exploitation pattern maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically through browser-based scripting execution. Attackers leverage this capability to execute arbitrary commands within the context of the victim's session, often using it as an initial access vector for more advanced persistent threats or lateral movement if other system components are similarly vulnerable.
To mitigate this vulnerability, immediate patching is required by upgrading phpMyFAQ to version 4.1.8 or later where the logic in FaqHelper::convertOldInternalLinks() has been corrected to prevent the reversal of entity encoding on user-supplied content. In environments where an upgrade cannot be implemented immediately, administrators should enforce strict input validation and output encoding practices that ensure data is encoded at the point of rendering rather than relying solely on pre-sanitization steps. Additionally, implementing a Content Security Policy with appropriate script-src directives can help mitigate the impact by restricting the execution of inline scripts even if they are successfully injected into the DOM. Regular security audits focusing on how legacy functions handle user input and ensuring that encoding is applied consistently across all output contexts will further reduce the risk of similar logical flaws in future updates or custom modifications.