Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.9, published 15 May 2026.

Which products and versions are affected?

phpmyfaq/phpmyfaq (Packagist) < 4.1.2; thorsten/phpmyfaq (Packagist) < 4.1.2; Thorsten phpMyFAQ < 4.1.2.

Is there a fix for This vulnerability?

A patch was published on 2026-06-09: Duplicate advisory GHSA-478m-mrw4-qf2w withdrawn in favor of GHSA-pqh6-8fxf-jx22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

phpMyFAQ stored XSS in search result rendering

Q: Is there a fix for This vulnerability?

A patch was published on 2026-06-09: Duplicate advisory GHSA-478m-mrw4-qf2w withdrawn in favor of GHSA-pqh6-8fxf-jx22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 6.9 · Published 2026-05-15

phpMyFAQ, an open-source FAQ software, is vulnerable to a security flaw that allows users with editor privileges to inject malicious scripts into the system. When other users or administrators search for content, these scripts execute in their browsers, potentially leading to the theft of login sessions or full account takeover. This could allow an attacker to compromise the entire FAQ platform and access sensitive administrative functions.

Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist), Thorsten phpMyFAQ. Vendors: Packagist, Thorsten.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.9, published 15 May 2026.
Which products and versions are affected?: phpmyfaq/phpmyfaq (Packagist) < 4.1.2; thorsten/phpmyfaq (Packagist) < 4.1.2; Thorsten phpMyFAQ < 4.1.2.
Is there a fix for This vulnerability?: A patch was published on 2026-06-09: Duplicate advisory GHSA-478m-mrw4-qf2w withdrawn in favor of GHSA-pqh6-8fxf-jx22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in phpMyFAQ before version 4.1.2 due to improper output encoding in the 'search.twig' template. The application uses the Twig '| raw' filter on 'result.question' and 'result.answerPreview' fields, which disables auto-escaping. Furthermore, 'SearchController.php' employs a flawed sanitization pattern using 'html_entity_decode(strip_tags())', which can be bypassed by submitting HTML-entity-encoded payloads. An attacker with FAQ editor or contributor privileges can store a malicious payload that, when rendered during a search, executes arbitrary JavaScript in the context of any user, including administrators. This can lead to session hijacking via cookie exfiltration. The issue is patched in version 4.1.2.

Affected products

thorsten phpMyFAQ < 4.1.2

Timeline

2026-04-28: advisory: Original advisory GHSA-pqh6-8fxf-jx22 published
2026-05-15: disclosed: CVE-2026-46361 published
2026-06-09: patched: Duplicate advisory GHSA-478m-mrw4-qf2w withdrawn in favor of GHSA-pqh6-8fxf-jx22

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.