CVE-2026-111894 Details
Description
phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.
A stored cross-site scripting vulnerability has been identified in phpMyFAQ versions 3.2.1 prior to 4.1.9, as well as in versions 4.2.0-alpha prior to 4.2.0-beta. This vulnerability allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources into FAQ or News content. The issue arises because the application's HTML sanitization process permits both iframes and data URIs, creating a loophole that attackers can exploit. The injected JavaScript is executed when the content is viewed, potentially leading to phishing attacks or unwanted redirects.
Users are advised to update phpMyFAQ to version 4.1.9 or later. Additionally, the HTML sanitizer configuration should be adjusted to disallow data URIs in iframes, and hardening measures such as adding a sandbox attribute to iframes, deploying a strong Content-Security-Policy, and restricting iframe sources to trusted hosts should be considered.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fg92-v5rr-4xjq | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-fg92-v5rr-4xjq | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-3.2.1-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-iframe-data-uri | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | <= 4.1.8 (semver) >= 4.2.0-alpha, < 4.2.0-beta (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |