CVE-2026-46361 Details
Description
phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.
A stored cross-site scripting vulnerability has been identified in phpMyFAQ versions prior to 4.1.2. The issue arises in the search.twig template, where the result.question and result.answerPreview fields are rendered using the raw filter, which disables the default autoescape feature. This allows attackers with FAQ editor privileges to inject HTML-entity-encoded payloads that bypass the html_entity_decode(strip_tags()) processing in SearchController.php. As a result, arbitrary JavaScript can be executed in the context of every visitor's browser, including administrators.
Users are advised to update to phpMyFAQ version 4.1.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 15, 2026CISA-ADP
Assessed May 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pqh6-8fxf-jx22 | CISA-ADP | AdvisoryTechnical AnalysisVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pqh6-8fxf-jx22 | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-stored-cross-site-scripting-via-raw-filter-in-search-twig | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | <= 4.1.1 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | [email protected] |
| May 16, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | New CVE Received | [email protected] |