The vulnerability in phpMyFAQ (CVE-2026-34974) is an improper neutralization of input during web page generation (CWE-79) affecting the regex-based SVG sanitizer (SvgSanitizer.php). Prior to version 4.1.1, the sanitizer fails to correctly handle HTML entity encoding in javascript: URLs embedded in SVG <a href> attributes, allowing an attacker with edit_faq permission to upload malicious SVG files. When these SVGs are viewed, arbitrary JavaScript can execute, enabling privilege escalation from editor to full administrator. The issue is resolved in phpMyFAQ version 4.1.1.

Successful exploitation allows an attacker with edit_faq permission to execute arbitrary JavaScript in the context of the application, leading to privilege escalation from editor to full administrator. This can compromise the integrity and control of the phpMyFAQ installation. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges at the editor level, user interaction required, and partial confidentiality and integrity impact without availability impact.

Upgrade phpMyFAQ to version 4.1.1 or later, where this vulnerability has been patched. No other mitigation is indicated or required as the fix addresses the root cause in the SVG sanitizer. Users should ensure they do not use vulnerable versions in production environments.