Executive brief
phpMyFAQ, an open-source FAQ software, is vulnerable to a security flaw that allows users with editor privileges to inject malicious scripts into the system. When other users or administrators search for content, these scripts execute in their browsers, potentially leading to the theft of login sessions or full account takeover. This could allow an attacker to compromise the entire FAQ platform and access sensitive administrative functions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in phpMyFAQ before version 4.1.2 due to improper output encoding in the 'search.twig' template. The application uses the Twig '| raw' filter on 'result.question' and 'result.answerPreview' fields, which disables auto-escaping. Furthermore, 'SearchController.php' employs a flawed sanitization pattern using 'html_entity_decode(strip_tags())', which can be bypassed by submitting HTML-entity-encoded payloads. An attacker with FAQ editor or contributor privileges can store a malicious payload that, when rendered during a search, executes arbitrary JavaScript in the context of any user, including administrators. This can lead to session hijacking via cookie exfiltration. The issue is patched in version 4.1.2.
Affected products
- thorsten phpMyFAQ < 4.1.2
Timeline
- 2026-04-28: advisory: Original advisory GHSA-pqh6-8fxf-jx22 published
- 2026-05-15: disclosed: CVE-2026-46361 published
- 2026-06-09: patched: Duplicate advisory GHSA-478m-mrw4-qf2w withdrawn in favor of GHSA-pqh6-8fxf-jx22