CVE-2026-46360
Fixed upstream EPSS <1%CVSS 5.4
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.
Products: thorsten phpmyfaq
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | phpmyfaq/phpmyfaq | 4.1.2 |
| Packagist | thorsten/phpmyfaq | 4.1.2 |