CVE-2026-111903: phpMyFAQ Stored XSS Vulnerability

CVE-2026-111903 Overview

CVE-2026-111903 is a stored cross-site scripting vulnerability [CWE-79] in phpMyFAQ versions 4.2.0-alpha before 4.2.0-beta. The flaw resides in the SvgSanitizer component, which fails to neutralize XML Document Type Definition (DTD) custom entities during SVG upload processing. Authenticated users holding the FAQ_EDIT permission can upload a crafted SVG that defines an entity expanding to a javascript: URI inside an anchor href. When a viewer clicks the rendered element, the attacker's script executes in the browser context of the victim. The vulnerability enables session hijacking against administrators who interact with the malicious content.

Critical Impact

Attackers with FAQ edit rights can execute arbitrary JavaScript in administrator browsers, enabling session hijacking and account takeover of privileged phpMyFAQ users.

Affected Products

• phpMyFAQ 4.2.0-alpha
• phpMyFAQ releases prior to 4.2.0-beta
• Deployments exposing the SvgSanitizer upload path to users with FAQ_EDIT permission

Discovery Timeline

• 2026-10-17 - CVE-2026-111903 published to the National Vulnerability Database
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111903

Vulnerability Analysis

The vulnerability stems from incomplete SVG sanitization in the SvgSanitizer class shipped with phpMyFAQ 4.2.0-alpha. The sanitizer inspects SVG elements and attributes for known dangerous patterns but does not resolve or strip XML DTD custom entity declarations before validation. An attacker defines an entity in the SVG prolog whose expanded value is a javascript: URI. The sanitizer evaluates the raw attribute value, which contains only an entity reference such as &xss;, and treats it as benign. When the browser later parses the stored SVG, it expands the entity and executes the script when a user activates the anchor.

The stored nature of the flaw amplifies impact. Any user viewing the affected FAQ entry becomes a potential victim, including administrators whose sessions grant full control over the phpMyFAQ instance.

Root Cause

The root cause is a sanitizer design that validates post-parse attribute content without accounting for DTD entity expansion performed by downstream SVG renderers. Allow-list checks on attributes such as href miss the javascript: payload because the dangerous string only materializes after the browser resolves the custom entity. This is a classic sanitization bypass pattern, mapped to CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires an authenticated account with the FAQ_EDIT permission and a victim willing to click the rendered element. The attacker uploads an SVG containing a DTD entity declaration, embeds a reference to that entity inside an anchor's href, and attaches the SVG to an FAQ entry. When an administrator opens the FAQ and clicks the shape, the browser navigates to the expanded javascript: URI, executing attacker-controlled code and exposing session cookies or anti-CSRF tokens. See the GitHub Security Advisory and the Vulncheck Stored XSS Advisory for additional technical context.

// No verified exploit code is published. The advisories describe
// an SVG payload that declares a DTD custom entity whose expansion
// resolves to a javascript: URI used as an anchor href.

Detection Methods for CVE-2026-111903

Indicators of Compromise

• SVG files uploaded through FAQ attachment endpoints containing a <!DOCTYPE> declaration with <!ENTITY> definitions.
• Stored FAQ content where anchor href attributes resolve to javascript: URIs after entity expansion.
• Unexpected administrative actions originating from browsers that recently rendered an attacker-controlled FAQ entry.

Detection Strategies

• Scan uploaded SVG assets for DTD entity declarations and reject or quarantine files that include them.
• Correlate FAQ_EDIT activity by non-administrative accounts with subsequent anomalous admin API calls.
• Review web server logs for requests to FAQ attachment paths serving SVG Content-Type responses to administrators.

Monitoring Recommendations

• Alert on new or modified FAQ entries that embed inline SVG or reference uploaded SVG files.
• Monitor browser Content Security Policy (CSP) violation reports originating from the phpMyFAQ domain.
• Track privilege changes and session creation events for administrator accounts after FAQ content is viewed.

How to Mitigate CVE-2026-111903

Immediate Actions Required

• Upgrade phpMyFAQ to version 4.2.0-beta or later, which contains the sanitizer fix.
• Audit all accounts holding the FAQ_EDIT permission and revoke rights that are not strictly required.
• Review existing FAQ entries for SVG attachments and remove any that declare DTDs or custom entities.

Patch Information

The phpMyFAQ maintainers addressed the issue in release 4.2.0-beta. Patch details are documented in the GitHub Security Advisory GHSA-j3v5-p957-w6gq. Operators running 4.2.0-alpha should treat the upgrade as mandatory before granting additional editor permissions.

Workarounds

• Disable SVG uploads in phpMyFAQ attachment configuration until the patched release is deployed.
• Enforce a strict Content Security Policy that blocks inline script execution and javascript: navigation.
• Serve user-uploaded SVG files from an isolated origin with Content-Disposition: attachment to prevent inline rendering.

# Example nginx response header hardening for phpMyFAQ attachments
location /attachments/ {
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'; style-src 'self'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Disposition "attachment" always;
}