CVE-2026-46367: phpMyFAQ stored XSS in Utils::parseUrl via comments

CVE-2026-46367 · Severity: high · CVSS 7.6 · Published 2026-05-15

A security vulnerability in phpMyFAQ, a popular open-source FAQ software, allows registered users to inject malicious scripts into comments. When an administrator or another visitor views the affected FAQ or news page, the script can execute in their browser, potentially allowing the attacker to steal login sessions and take full control of the application. This issue occurs when the comment editor feature is enabled and can be triggered by simply hovering over a malicious link.

Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist), Thorsten phpMyFAQ. Vendors: Packagist, Thorsten.

Quick answers

Is CVE-2026-46367 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46367 being exploited in the wild.
How severe is CVE-2026-46367?
High severity, with a CVSS score of 7.6, published 15 May 2026.
Which products and versions are affected?
phpmyfaq/phpmyfaq (Packagist) < 4.1.2, = 4.1.1, ECOSYSTEM:introduced=4.1.1,fixed=4.1.2; thorsten/phpmyfaq (Packagist) = 4.1.1, ECOSYSTEM:introduced=4.1.1,fixed=4.1.2; Thorsten phpMyFAQ >= 4.1.1, < 4.1.2, 4.1.1.
Is there a fix for CVE-2026-46367?
Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46367 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-46367?
Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later
    composer require phpmyfaq/phpmyfaq:^4.1.2
  • thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later
    composer require thorsten/phpmyfaq:^4.1.2

Technical details

A stored XSS vulnerability exists in phpMyFAQ 4.1.1 within the comment rendering pipeline. The root cause is located in `Utils::parseUrl()`, which uses a regular expression to convert URLs into clickable links without proper HTML entity encoding. Specifically, the regex `[^\s]+` fails to exclude double quotes, allowing an attacker to break out of the `href` attribute and inject event handlers like `onmouseover`. This vulnerability is reachable when `main.enableCommentEditor` is enabled, as the application uses `sanitizeHtmlComment()` and Twig's `|raw` filter, bypassing standard escaping mechanisms. An authenticated attacker can exploit this to steal session cookies from other users and administrators. The issue is patched in version 4.1.2.

Affected products

  • thorsten phpMyFAQ 4.1.1

Identifiers

  • CVE-2026-46367
  • GHSA-9525-27vj-c8r8
  • GHSA-w42g-jj8w-fj77

Timeline

  • 2026-04-28: disclosed: Vulnerability reported to vendor
  • 2026-05-06: advisory: GitHub Advisory published
  • 2026-05-06: patched: Version 4.1.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.