Is CVE-2026-111896 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111896 being exploited in the wild.

How severe is CVE-2026-111896?

Medium severity, with a CVSS score of 5.4, published 17 October 2026.

Which products and versions are affected?

Thorsten phpMyFAQ 4.2.0-alpha to before 4.2.0-beta.

How is CVE-2026-111896 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111896?

Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111896: phpMyFAQ stored cross-site scripting in SvgSanitizer

CVE-2026-111896 · Severity: medium · CVSS 5.4 · Published 2026-10-17

phpMyFAQ is a frequently-asked-questions system that allows users to create and edit FAQ content. A flaw in the SVG file sanitization component allows editors with upload privileges to store malicious SVG files containing executable scripts. When another user (including administrators) opens the file, the script runs with the application's privileges, potentially exposing sensitive data or enabling account takeover.

Technologies: Thorsten phpMyFAQ. Vendors: Thorsten.

Quick answers

Is CVE-2026-111896 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111896 being exploited in the wild.
How severe is CVE-2026-111896?: Medium severity, with a CVSS score of 5.4, published 17 October 2026.
Which products and versions are affected?: Thorsten phpMyFAQ 4.2.0-alpha to before 4.2.0-beta.
Is there a fix for CVE-2026-111896?: Yes: fixed in 4.2.0-beta. Until then: Disable SVG upload functionality by removing image/svg+xml from the ALLOWED_MIME_TYPES in ImageController, or restrict SVG upload access to trusted administrators only. Configure a strict Content-Security-Policy header that prevents inline script execution and restricts script-src to trusted sources. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111896 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111896?: Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.2.0-beta

Disable SVG upload functionality by removing image/svg+xml from the ALLOWED_MIME_TYPES in ImageController, or restrict SVG upload access to trusted administrators only. Configure a strict Content-Security-Policy header that prevents inline script execution and restricts script-src to trusted sources.

Technical details

The SvgSanitizer::removeDangerousContent() method removes dangerous patterns with non-overlapping regex replacements in a single pass and does not re-scan the output. An attacker can craft an SVG payload that splits script tags around tokens (like processing instructions) that are themselves removed, so the removal of the token reassembles the script tag. The vulnerability requires FAQ_EDIT permission and a valid CSRF token, and is triggered when an attacker uploads the malicious SVG and a victim views the file in a browser, causing the script to execute in the application origin.

Affected products

thorsten phpMyFAQ 4.2.0-alpha to before 4.2.0-beta

Timeline

2026-10-03: disclosed
2026-10-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.