Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-111894 Overview
CVE-2026-111894 is a stored cross-site scripting (XSS) vulnerability in phpMyFAQ, an open-source FAQ management system. The flaw affects phpMyFAQ versions 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. Authenticated content authors can inject JavaScript by embedding <iframe> elements with data:text/html sources inside FAQ or News content. The payload bypasses the hostless media-host allowlist enforced by FaqHelper::cleanUpContent() and is rendered through Twig's raw filter. The vulnerability is classified under CWE-79.
Critical Impact
Authenticated authors can serve phishing interfaces or trigger top-frame redirects for every viewer of a poisoned FAQ or News entry.
Affected Products
- phpMyFAQ 3.2.1 through versions prior to 4.1.9
- phpMyFAQ 4.2.0-alpha through versions prior to 4.2.0-beta
- Deployments exposing FAQ or News authoring to multiple content contributors
Discovery Timeline
- 2026-10-17 - CVE-2026-111894 published to the National Vulnerability Database (NVD)
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-111894
Vulnerability Analysis
phpMyFAQ sanitizes rich text submitted by authors through the FaqHelper::cleanUpContent() helper. The helper applies an allowlist that limits which hosts can appear inside embedded media elements such as <iframe>. The allowlist evaluates the host component of a URL, but data: URIs are hostless. The check treats hostless sources as acceptable rather than rejecting them outright. Twig then renders the stored content through the raw filter, which disables output escaping. The combined effect is that malicious iframe markup survives sanitization and is written directly into the response HTML.
Root Cause
The root cause is incomplete input validation in FaqHelper::cleanUpContent(). The allowlist logic focuses on host values and does not reject URI schemes that cannot be constrained by host matching, including data:, javascript:, and blob:. Because the final template emits the sanitized text through Twig's raw filter, the application depends entirely on this sanitizer for safety. Any gap in the allowlist translates directly into stored XSS.
Attack Vector
An attacker needs an account with permission to create or edit FAQ or News entries. The attacker submits content containing an <iframe> whose src attribute uses a data:text/html URI carrying arbitrary HTML and JavaScript. After the entry is published, every visitor who loads the page executes the attacker-controlled payload inside the phpMyFAQ origin. Common follow-on actions include rendering fake login forms over the FAQ chrome and issuing top-frame navigations to attacker-controlled domains. See the GitHub Security Advisory and the VulnCheck Advisory on phpMyFAQ for additional technical context.
Detection Methods for CVE-2026-111894
Indicators of Compromise
- FAQ or News records containing <iframe tags with src values beginning with data:text/html
- Stored content referencing javascript: or blob: URI schemes inside embedded media attributes
- Outbound navigation events from FAQ viewers to unfamiliar domains immediately after page load
- Author activity creating or editing entries with unusually large base64 blobs in body fields
Detection Strategies
- Query the phpMyFAQ database for FAQ and News rows whose content matches the regular expression <iframe[^>]+src=['"]data: and review every hit.
- Enable Content Security Policy (CSP) reporting in report-only mode to surface iframe sources that violate a strict frame-src policy.
- Review web server access logs for repeated page loads followed by redirects to external hosts originating from FAQ URLs.
Monitoring Recommendations
- Audit the phpMyFAQ user table for accounts holding author or editor roles and confirm each account is legitimate.
- Alert on edits to FAQ or News entries that increase content size beyond a reasonable threshold for text updates.
- Monitor browser error telemetry for CSP violations referencing data: schemes on phpMyFAQ pages.
How to Mitigate CVE-2026-111894
Immediate Actions Required
- Upgrade phpMyFAQ to version 4.1.9 or 4.2.0-beta or later, depending on the installed release branch.
- Rotate credentials for any author or editor account that cannot be positively attributed to a trusted operator.
- Scan existing FAQ and News content for iframe tags with data:, javascript:, or blob: URIs and remove them.
Patch Information
The maintainers resolved the issue in phpMyFAQ 4.1.9 and 4.2.0-beta by tightening FaqHelper::cleanUpContent() to reject hostless URI schemes in embedded media sources. Operators running any 3.2.1 through 4.1.8 release or the 4.2.0-alpha prerelease must upgrade. Deployment details are available in the GitHub Security Advisory.
Workarounds
- Restrict FAQ and News authoring permissions to a minimal set of trusted administrators until the upgrade is applied.
- Deploy a strict Content Security Policy that forbids data: and javascript: URIs in frame-src, child-src, and script-src directives.
- Place a web application firewall (WAF) rule in front of phpMyFAQ that blocks POST bodies containing <iframe combined with data:text/html.
# Example CSP header to block data: iframe payloads
Content-Security-Policy: default-src 'self'; frame-src 'self' https:; child-src 'self' https:; script-src 'self'; object-src 'none'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
