CVE-2026-32629 in phpMyFAQ

Resumen (Inglés)

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 (quoted local part) yet contains raw HTML — for example "alert(1)"@evil.com. PHP's FILTER_VALIDATE_EMAIL accepts this email as valid. The email is stored in the database without HTML sanitization and later rendered in the admin FAQ editor template using Twig's |raw filter, which bypasses auto-escaping entirely. This issue has been patched in version 4.1.1.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Responsable

GitHub_M

Reservar

2026-03-12

Divulgación

2026-04-02

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
354886	thorsten phpMyFAQ Ejecución remota de código		No está definido	Arreglo oficial	CVE-2026-32629

Fuentes

• MITRE
• NVD
• CVE Details