Executive brief
phpMyFAQ is a popular open-source FAQ management system used to publish frequently asked questions on websites. The vulnerability allows authenticated users with FAQ editing privileges to embed malicious JavaScript code into FAQ answers that executes for all visitors viewing those pages, potentially stealing session cookies, redirecting users, or defacing content.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in FaqHelper::convertOldInternalLinks() within phpMyFAQ versions before 4.1.8. The root cause is that html_entity_decode() is called on the entire sanitized FAQ answer body, reversing entity-encoding protections applied by Symfony's HtmlSanitizer. Disallowed HTML tags like <img src=x onerror=alert(1)> that were safely entity-encoded to &lt;img...&gt; are decoded back to live HTML. The attack requires authentication with FAQ editing privileges and a legacy-format internal link URL in the answer to trigger the vulnerable code path. Once an attacker-controlled FAQ is published, the JavaScript payload executes in every visitor's browser without further sanitization. The fix, available in version 4.1.8, removes the html_entity_decode() call and operates directly on the sanitized answer string.
Affected products
- Thorsten Hahn phpMyFAQ < 4.1.8
Timeline
- 2026-08-20: disclosed: GitHub Security Advisory GHSA-x6qj-5jhf-xgpm published
- 2026-08-20: patched: Fix available in phpMyFAQ 4.1.8