CVE-2026-56736: phpMyFAQ stored XSS in admin FAQ editor via HTML entity bypass

CVE-2026-56736 · Severity: high · CVSS 8.2 · Published 2026-09-24

phpMyFAQ is a frequently asked questions (FAQ) management system. An unauthenticated user can inject malicious JavaScript code into an FAQ submission that executes in an administrator's browser when they review or edit the entry, enabling session hijacking and full admin account takeover. The vulnerability exists in the default configuration where guests can submit FAQs and rich-text editing is enabled.

Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-56736 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56736 being exploited in the wild.
How severe is CVE-2026-56736?
High severity, with a CVSS score of 8.2, published 24 September 2026.
Which products and versions are affected?
phpmyfaq/phpmyfaq (Packagist) < 4.2.0-alpha, ECOSYSTEM:introduced=0,fixed=4.2.0-alpha; thorsten/phpmyfaq (Packagist) < 4.2.0-alpha, ECOSYSTEM:introduced=0,fixed=4.2.0-alpha.
Is there a fix for CVE-2026-56736?
Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.2.0-alpha or later; thorsten/phpmyfaq (Packagist): upgrade to 4.2.0-alpha or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56736 attacked?
It is attacked over the network.
Am I affected by CVE-2026-56736?
Check whether you run phpmyfaq/phpmyfaq (Packagist) or thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpmyfaq/phpmyfaq (Packagist): upgrade to 4.2.0-alpha or later
    composer require phpmyfaq/phpmyfaq:^4.2.0-alpha
  • thorsten/phpmyfaq (Packagist): upgrade to 4.2.0-alpha or later
    composer require thorsten/phpmyfaq:^4.2.0-alpha

Technical details

A stored XSS vulnerability in the FAQ submission API (phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/FaqController.php) arises from improper input sanitization. The code applies `strip_tags()` via `FILTER_SANITIZE_SPECIAL_CHARS` to remove HTML tags, but `strip_tags()` does not remove HTML entities (e.g., `&lt;script&gt;`). When the WYSIWYG editor is enabled on the frontend, a subsequent call to `html_entity_decode()` converts these entities to executable HTML before storage in the database. The admin FAQ editor template (phpmyfaq/assets/templates/admin/content/faq.editor.twig) renders the stored content with Twig's `|raw` filter, executing the injected script in the administrator's browser context. An unauthenticated attacker can craft a POST request to the `/api/faq/create` endpoint with a payload using HTML entity encoding (e.g., `&lt;/textarea&gt;&lt;img src=x onerror=alert()&gt;&lt;textarea&gt;`) to break out of the textarea element and trigger JavaScript execution when an admin edits the submission.

Affected products

  • phpMyFAQ phpMyFAQ

Identifiers

  • CVE-2026-56736
  • GHSA-pgwp-vc7q-cvj3

Timeline

  • 2026-09-24: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.