github.com
https://github.com/thorsten/phpMyFAQ CVE-2026-46360
MEDIUM
phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer
Record summary
CVE-2026-46360 has a selected CVSS score of 5.1 (medium).
Description
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 15, 2026 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
phpmyfaqBrowse thorsten / phpmyfaqDefault status: unaffected | CVE List | Before 4.1.2 | affected |
| 4.1.2 | unaffected | ||
phpmyfaq/phpmyfaqBrowse Packagist / phpmyfaq/phpmyfaq | GitHub Advisory | Before 4.1.2 · Fixed in 4.1.2 | affected |
thorsten/phpmyfaqBrowse Packagist / thorsten/phpmyfaq | GitHub Advisory | Before 4.1.2 · Fixed in 4.1.2 | affected |
References
4GHSA Advisory GHSA-whqh-9pq5-c7r3Vendor advisory
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-whqh-9pq5-c7r3 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-46360 VulnCheck Advisory: phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG SanitizerThird-party advisory
https://www.vulncheck.com/advisories/phpmyfaq-stored-xss-via-entity-decoding-depth-limit-bypass-in-svg-sanitizer