# CVE-2026-46363: phpMyFAQ stored XSS in FAQ creation and update endpoints

Source: https://junglewise.ai/threats/cve-2026-46363-phpmyfaq-stored-xss-in-faq-creation-and-update-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-46363 · Severity: medium · CVSS 5.4 · Published 2026-05-15

phpMyFAQ, an open-source FAQ software, contains a vulnerability that allows users with FAQ creation permissions to inject malicious scripts into FAQ entries. When other users or administrators view these entries, the scripts execute in their browsers, potentially leading to account takeover, session hijacking, or the display of fraudulent content. This risk is particularly high for organizations where multiple contributors manage the knowledge base.

Technologies: [phpmyfaq/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq), [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq), [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-46363 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46363 being exploited in the wild.

**How severe is CVE-2026-46363?** Medium severity, with a CVSS score of 5.4, published 15 May 2026.

**Which products and versions are affected?** phpmyfaq/phpmyfaq (Packagist) < 4.1.2, <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; thorsten/phpmyfaq (Packagist) < 4.1.2, <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; Thorsten phpMyFAQ < 4.1.2.

**Is there a fix for CVE-2026-46363?** Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46363 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-46363?** Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later

  ```sh
  composer require phpmyfaq/phpmyfaq:^4.1.2
  ```

- thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later

  ```sh
  composer require thorsten/phpmyfaq:^4.1.2
  ```


## Technical details

A Stored XSS vulnerability exists in phpMyFAQ's FAQ creation and update endpoints within `FaqController.php`. The application uses a flawed sanitization chain where input is first HTML-encoded via `FILTER_SANITIZE_SPECIAL_CHARS`, but then immediately decoded using `html_entity_decode()`. The subsequent call to `Filter::removeAttributes()` only strips specific HTML attributes but fails to filter dangerous tags like `<script>`, `<iframe>`, or `<object>`. Furthermore, the Twig templates (`faq.twig` and `search.twig`) use the `|raw` filter, which prevents auto-escaping during rendering. An authenticated attacker with `FAQ_ADD` permissions can exploit this to execute arbitrary JavaScript in the context of any user viewing the FAQ. The issue is fixed in version 4.1.2.

## Affected products

- thorsten phpMyFAQ <= 4.1.1

## Identifiers

- CVE-2026-46363
- GHSA-f5p7-2c9q-8896
- GHSA-h36g-93qx-rxgr

## Timeline

- 2026-04-28: disclosed
- 2026-05-06: advisory: GitHub Advisory published
- 2026-04-28: patched: Version 4.1.2 released

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)