CVE-2026-111896
Deferred Deferred - Pending Action

Stored XSS in phpMyFAQ via SVG Sanitizer Bypass

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111896
EUVD
EUVD-2026-103323

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thorsten phpMyFAQ 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-182 The product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value that violates an expected security property.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta. It involves the SvgSanitizer component failing to properly sanitize SVG files uploaded by FAQ editors. Attackers can bypass sanitization by splitting script tags around removed tokens like processing instructions. When the file is later opened, the split tags reassemble into executable script tags, running malicious code in the application's origin.

Detection Guidance

Check phpMyFAQ installations for versions 4.2.0-alpha.2 and later. Inspect uploaded SVG files for split script tags like <scr<?php?>ipt> or similar obfuscation. Review server logs for SVG uploads by users with FAQ_EDIT permissions.

Impact Analysis

If you are a user who opens a manipulated SVG file uploaded to a vulnerable phpMyFAQ instance, the vulnerability could allow an attacker to execute arbitrary JavaScript in your browser within the application's context. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on your behalf.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially exposing user data or session tokens through cross-site scripting attacks. If sensitive data is accessed or modified due to the vulnerability, it may violate data protection requirements under these regulations, leading to legal and regulatory consequences for affected organizations.

Mitigation Strategies

Upgrade phpMyFAQ to a patched version. Disable SVG uploads if not required. Implement stricter file validation for SVG uploads. Review and remove any suspicious SVG files already stored. Monitor for unauthorized script execution in application logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111896. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart