Is CVE-2026-46363 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46363 being exploited in the wild.

How severe is CVE-2026-46363?

Medium severity, with a CVSS score of 5.4, published 15 May 2026.

Which products and versions are affected?

phpmyfaq/phpmyfaq (Packagist) < 4.1.2, <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; thorsten/phpmyfaq (Packagist) < 4.1.2, <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; Thorsten phpMyFAQ < 4.1.2.

Is there a fix for CVE-2026-46363?

Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46363 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-46363?

Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46363: phpMyFAQ stored XSS in FAQ creation and update endpoints

Q: Is there a fix for CVE-2026-46363?

Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46363 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-46363?

Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46363 · Severity: medium · CVSS 5.4 · Published 2026-05-15

phpMyFAQ, an open-source FAQ software, contains a vulnerability that allows users with FAQ creation permissions to inject malicious scripts into FAQ entries. When other users or administrators view these entries, the scripts execute in their browsers, potentially leading to account takeover, session hijacking, or the display of fraudulent content. This risk is particularly high for organizations where multiple contributors manage the knowledge base.

Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist), Thorsten phpMyFAQ. Vendors: Packagist, Thorsten.

Quick answers

Is CVE-2026-46363 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46363 being exploited in the wild.
How severe is CVE-2026-46363?: Medium severity, with a CVSS score of 5.4, published 15 May 2026.
Which products and versions are affected?: phpmyfaq/phpmyfaq (Packagist) < 4.1.2, <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; thorsten/phpmyfaq (Packagist) < 4.1.2, <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; Thorsten phpMyFAQ < 4.1.2.
Is there a fix for CVE-2026-46363?: Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46363 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-46363?: Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later
```
composer require phpmyfaq/phpmyfaq:^4.1.2
```
thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later
```
composer require thorsten/phpmyfaq:^4.1.2
```

Technical details

A Stored XSS vulnerability exists in phpMyFAQ's FAQ creation and update endpoints within `FaqController.php`. The application uses a flawed sanitization chain where input is first HTML-encoded via `FILTER_SANITIZE_SPECIAL_CHARS`, but then immediately decoded using `html_entity_decode()`. The subsequent call to `Filter::removeAttributes()` only strips specific HTML attributes but fails to filter dangerous tags like `<script>`, `<iframe>`, or `<object>`. Furthermore, the Twig templates (`faq.twig` and `search.twig`) use the `|raw` filter, which prevents auto-escaping during rendering. An authenticated attacker with `FAQ_ADD` permissions can exploit this to execute arbitrary JavaScript in the context of any user viewing the FAQ. The issue is fixed in version 4.1.2.

Affected products

thorsten phpMyFAQ <= 4.1.1

Identifiers

CVE-2026-46363
GHSA-f5p7-2c9q-8896
GHSA-h36g-93qx-rxgr

Timeline

2026-04-28: disclosed
2026-05-06: advisory: GitHub Advisory published
2026-04-28: patched: Version 4.1.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.