CVE-2026-34974
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
phpMyFAQ before version 4.1.1 contains an XSS vulnerability in the regex-based SVG sanitizer. Attackers with edit_faq permission can upload a malicious SVG that uses HTML entity encoding in javascript: URLs within <a href> attributes, leading to arbitrary JavaScript execution and privilege escalation to full admin takeover.
Risk Assessment
Attackers can gain full control over the phpMyFAQ application, including access to all data and administrative functions.
Recommendation
Update phpMyFAQ to version 4.1.1 or later.
Original NVD description (English source)
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the regex-based SVG sanitizer in phpMyFAQ (SvgSanitizer.php) can be bypassed using HTML entity encoding in javascript: URLs within SVG <a href> attributes. Any user with edit_faq permission can upload a malicious SVG that executes arbitrary JavaScript when viewed, enabling privilege escalation from editor to full admin takeover. This issue has been patched in version 4.1.1.