CVE-2026-46360

MEDIUM5.4EPSS 0.03%

phpMyFAQ: SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

Published: 5/15/2026Modified: 5/21/2026

Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.

Affected packages (2)

Packagist/phpMyFAQ/phpMyFAQfrom 0, < 4.1.2
Packagist/thorsten/phpMyFAQfrom 0, < 4.1.2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-46360
PATCHhttps://github.com/thorsten/phpMyFAQ
WEBhttps://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-whqh-9pq5-c7r3
WEBhttps://www.vulncheck.com/advisories/phpmyfaq-stored-xss-via-entity-decoding-depth-limit-bypass-in-svg-sanitizer