CVE-2026-46363: phpMyFAQ Stored XSS Vulnerability

CVE-2026-46363 Overview

CVE-2026-46363 is a stored cross-site scripting (XSS) vulnerability affecting phpMyFAQ versions prior to 4.1.2. The flaw resides in the FAQ creation and update endpoints, where input sanitization is bypassed through encode-decode cycles. Authenticated attackers holding the FAQ_ADD permission can inject malicious script tags via the question or answer parameters. The injected payload executes in every visitor's browser when the FAQ content is rendered through the raw Twig filter. This vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in the browsers of all users viewing affected FAQ entries, enabling session theft, credential harvesting, and unauthorized actions on behalf of victims.

Affected Products

• phpMyFAQ versions prior to 4.1.2
• Installations exposing FAQ creation and update endpoints to users with FAQ_ADD permission
• Deployments rendering FAQ content through the raw Twig filter

Discovery Timeline

• 2026-05-15 - CVE-2026-46363 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-46363

Vulnerability Analysis

The vulnerability arises from inconsistent handling of user-supplied content between the input sanitization layer and the output rendering layer. phpMyFAQ accepts FAQ question and answer fields from authenticated users with the FAQ_ADD permission. The application applies encoding routines to incoming content, but subsequent decoding operations before storage or rendering reintroduce executable script content.

When the stored FAQ entry is later rendered using the raw Twig filter, the template engine emits the content without escaping. Any HTML or JavaScript previously smuggled through the encode-decode cycle executes in the visitor's browser session. The cross-site scripting condition is persistent, affecting every user who views the compromised FAQ entry.

Root Cause

The root cause is a sanitization bypass through encode-decode cycles combined with the use of Twig's raw filter on attacker-controllable content. Encoding and decoding payloads through multiple transformations allows malicious markup to evade the input filters. The raw filter then disables Twig's default auto-escaping, removing the final defensive boundary against script injection.

Attack Vector

Exploitation requires an authenticated account with the FAQ_ADD permission and victim interaction to view the FAQ. An attacker submits a crafted question or answer containing encoded script content that survives the sanitization pipeline. Once an administrator approves or a user navigates to the entry, the payload executes within the application origin. The scope change reflected in the CVSS vector indicates the impact extends to other components such as user sessions and browser context. See the GitHub Security Advisory and the VulnCheck Advisory on phpMyFAQ for additional technical context.

Detection Methods for CVE-2026-46363

Indicators of Compromise

• FAQ database entries containing <script> tags, javascript: URIs, or HTML event handlers such as onerror and onload
• Unexpected outbound HTTP requests from browser sessions immediately after loading FAQ pages
• Audit log entries showing FAQ creation or update actions from low-privilege accounts holding only FAQ_ADD permission
• HTML-encoded or URL-encoded script fragments appearing in the question or answer columns of the FAQ table

Detection Strategies

• Inspect stored FAQ content for encoded patterns that decode to executable HTML or JavaScript
• Review web server access logs for POST requests to FAQ creation and update endpoints containing suspicious payloads in question or answer fields
• Monitor application audit trails for FAQ submissions from accounts created shortly before content insertion
• Deploy Content Security Policy (CSP) violation reporting to surface unexpected script execution on FAQ pages

Monitoring Recommendations

• Alert on anomalous JavaScript execution within FAQ rendering routes
• Correlate authentication events with FAQ content modifications to identify suspicious authoring patterns
• Track outbound traffic from administrative browser sessions for signs of session token exfiltration

How to Mitigate CVE-2026-46363

Immediate Actions Required

• Upgrade phpMyFAQ to version 4.1.2 or later as a priority
• Audit existing FAQ entries for malicious or encoded script content and remove suspicious records
• Review and tighten allocation of the FAQ_ADD permission to trusted accounts only
• Rotate session secrets and force re-authentication if compromised content has been served to users

Patch Information

The vendor addressed CVE-2026-46363 in phpMyFAQ version 4.1.2. The fix corrects the sanitization pipeline to prevent encode-decode bypass and removes unsafe use of the raw Twig filter on user-controllable FAQ fields. Refer to the GitHub Security Advisory GHSA-f5p7-2c9q-8896 for full patch details.

Workarounds

• Restrict the FAQ_ADD permission to a minimal set of trusted administrators until patching is complete
• Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources
• Temporarily disable rendering of unreviewed FAQ entries on public-facing pages
• Place a web application firewall rule in front of FAQ creation endpoints to block payloads containing script tags and common XSS vectors

# Example: restrict FAQ endpoints at the reverse proxy until patched
location ~ ^/admin/faq/(save|update) {
    deny all;
    return 403;
}