CVE-2026-46363 Details

A stored cross-site scripting vulnerability has been identified in phpMyFAQ versions prior to 4.1.2. This issue resides in the FAQ creation and update endpoints, where sanitization is bypassed through a cycle of encoding and decoding. The vulnerability allows authenticated attackers with FAQ_ADD permission to inject malicious script tags into the question or answer parameters. These scripts execute in the browsers of all visitors when the FAQ content is displayed using the raw Twig filter.

Users are advised to update phpMyFAQ to version 4.1.2 or later. For a more robust solution, replace the current HTML sanitization process with a library that can properly sanitize HTML at the DOM level, such as HTML Purifier or Symfony's HtmlSanitizer component.