CVE-2026-111903: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in thorsten phpMyFAQ

The vulnerability in phpMyFAQ's SvgSanitizer allows users with FAQ_EDIT permission to upload SVG files containing XML DTD custom entities that bypass sanitization. This leads to stored cross-site scripting, where JavaScript can be injected into anchor href attributes. The injected script executes when clicked by viewers, enabling session hijacking of admin users. The affected versions are >=4.2.0-alpha and <4.2.0-beta. No known exploits are reported in the wild, and no patch or remediation details are provided in the input data.

Successful exploitation allows an attacker with FAQ_EDIT permissions to inject malicious JavaScript that executes when other users click crafted links, potentially hijacking admin sessions. This can lead to unauthorized actions performed with admin privileges. The vulnerability requires user interaction (clicking the malicious link) and privileges to upload SVG content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict FAQ_EDIT permissions to trusted users only and avoid clicking untrusted SVG links. Monitor vendor communications for official patches or updates addressing this vulnerability.