Executive brief
phpMyFAQ is an open-source web application used for managing frequently asked questions. A security flaw allows users with basic editing permissions to upload malicious image files (SVGs) that contain hidden scripts. If an administrator views these files, the scripts can run automatically, allowing the attacker to create new administrator accounts or take full control of the system.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in phpMyFAQ's SvgSanitizer.php due to an insufficient regex-based sanitization mechanism. The sanitizer attempts to block 'javascript:' URLs using a regular expression that does not account for HTML entity encoding (e.g., j). An attacker with 'edit_faq' permissions can upload a malicious SVG file containing encoded JavaScript within an <a> tag's href attribute. Because the application serves SVGs with 'image/svg+xml' and lacks a 'Content-Disposition: attachment' header, the browser executes the script in the context of the application's origin when viewed. This allows an attacker to perform actions on behalf of an authenticated administrator, such as creating new admin users via the API. The issue is fixed in version 4.1.1.
Affected products
- thorsten phpMyFAQ < 4.1.1
Timeline
- 2026-01-15: other: Vulnerable SvgSanitizer.php component introduced
- 2026-03-31: patched: Version 4.1.1 released
- 2026-04-02: disclosed: Public advisory published