CVE-2026-32629 describes an improper input validation vulnerability (CWE-20) in phpMyFAQ before version 4.1.1. The vulnerability arises because the application accepts email addresses that are syntactically valid per RFC 5321 but contain raw HTML code, such as a script tag. PHP's FILTER_VALIDATE_EMAIL function accepts these emails as valid, but the application stores them without sanitizing the HTML content. Later, the email is rendered in the admin FAQ editor template using Twig's |raw filter, which disables auto-escaping and allows the embedded HTML to execute. This results in a stored cross-site scripting (XSS) vulnerability (CWE-79). The vulnerability is patched in phpMyFAQ version 4.1.1.

An unauthenticated attacker can submit a malicious email address containing raw HTML that is stored and later rendered in the admin interface without escaping. This can lead to stored cross-site scripting (XSS) attacks against administrators viewing the FAQ editor, potentially allowing execution of arbitrary scripts in the admin context. The CVSS 4.0 base score is 5.4 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and high scope and impact on integrity and availability.

Upgrade phpMyFAQ to version 4.1.1 or later, where this vulnerability has been patched. The vendor has fixed the issue by properly sanitizing email inputs and avoiding unsafe rendering with Twig's |raw filter. No additional mitigation is required if the system is updated.