CVE-2026-34974

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the regex-based SVG sanitizer in phpMyFAQ (SvgSanitizer.php) can be bypassed using HTML entity encoding in javascript: URLs within SVG <a href> attributes. Any user with edit_faq permission can upload a malicious SVG that executes arbitrary JavaScript when viewed, enabling privilege escalation from editor to full admin takeover. This issue has been patched in version 4.1.1.

Score

CVSS 3.1 5.4 Medium

Status

Analyzed - security-advisories@github.com

Published

2026-04-02

Last modified

2026-04-02

Weaknesses

CWE-79

Affected products

• Phpmyfaq (Phpmyfaq)
• Phpmyfaq (Thorsten)

References

• https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-5crx-pfhq-4hgg