Executive brief
phpMyFAQ is an open-source FAQ software. A vulnerability in its search result rendering allows users with low-level editing privileges to inject malicious scripts into the platform. When other users or administrators perform a search that matches the poisoned content, the script executes in their browser, potentially leading to account takeover or the theft of sensitive session information.
Technical details
A stored XSS vulnerability exists in phpMyFAQ versions up to 4.1.1. The root cause is twofold: first, the `search.twig` template uses the `| raw` filter on user-controlled fields like `result.question` and `result.answerPreview`, disabling Twig's auto-escaping. Second, `SearchController.php` employs an insecure sanitization pattern where `html_entity_decode()` is called after `strip_tags()`, allowing attackers to bypass tag stripping by using HTML entities. An attacker with FAQ editor or contributor privileges can inject a payload that is stored in the database and subsequently executed in the context of any user who triggers a search matching the malicious entry. This can lead to session cookie exfiltration and full account takeover. The issue is addressed in version 4.1.2.
Affected products
- thorsten phpMyFAQ <= 4.1.1
Timeline
- 2026-04-28: disclosed
- 2026-05-06: advisory: GHSA-pqh6-8fxf-jx22 published
- 2026-04-28: patched: Fixed in version 4.1.2