The vulnerability in phpMyFAQ before version 4.1.2 is a stored cross-site scripting issue located in the SvgSanitizer::decodeAllEntities() function. The sanitization process limits recursive decoding to five iterations, which is insufficient to prevent attackers from bypassing it. Authenticated users with FAQ_EDIT permissions can exploit this by uploading SVG files with deeply nested ampersand-encoded numeric HTML entities that reconstruct javascript: URLs. These URLs execute arbitrary JavaScript when clicked by other users viewing the SVG content, potentially leading to script execution in the context of the victim's browser session.

An attacker with authenticated FAQ_EDIT permissions can upload malicious SVG files that execute arbitrary JavaScript in the browsers of other users who view and interact with the SVG content. This can lead to client-side script execution, potentially compromising user sessions or performing actions on behalf of the victim. The vulnerability does not affect system availability and has limited confidentiality and integrity impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and the remediation level is not specified, users should monitor the vendor's announcements for updates. In the meantime, restrict FAQ_EDIT permissions to trusted users only and consider disabling SVG uploads or sanitizing SVG content with more robust tools to prevent exploitation.