Executive brief
A security vulnerability in phpMyFAQ, a popular open-source FAQ software, allows registered users to inject malicious scripts into comments. When an administrator or another visitor views the affected FAQ or news page, the script can execute in their browser, potentially allowing the attacker to steal login sessions and take full control of the application. This issue occurs when the comment editor feature is enabled and can be triggered by simply hovering over a malicious link.
Technical details
A stored XSS vulnerability exists in phpMyFAQ 4.1.1 within the comment rendering pipeline. The root cause is located in `Utils::parseUrl()`, which uses a regular expression to convert URLs into clickable links without proper HTML entity encoding. Specifically, the regex `[^\s]+` fails to exclude double quotes, allowing an attacker to break out of the `href` attribute and inject event handlers like `onmouseover`. This vulnerability is reachable when `main.enableCommentEditor` is enabled, as the application uses `sanitizeHtmlComment()` and Twig's `|raw` filter, bypassing standard escaping mechanisms. An authenticated attacker can exploit this to steal session cookies from other users and administrators. The issue is patched in version 4.1.2.
Affected products
- thorsten phpMyFAQ 4.1.1
Timeline
- 2026-04-28: disclosed: Vulnerability reported to vendor
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-06: patched: Version 4.1.2 released