The vulnerability in phpMyFAQ prior to version 4.1.2 is a stored cross-site scripting issue caused by insufficient neutralization of input during web page generation. Specifically, the SvgSanitizer::decodeAllEntities() function limits recursive decoding of entities to 5 iterations, which attackers can bypass by deeply nesting ampersand encoding around numeric HTML entities. Authenticated users with FAQ_EDIT permissions can exploit this to upload SVG files that reconstruct javascript: URLs, leading to arbitrary JavaScript execution when other users view the SVG content.

Successful exploitation allows an authenticated user with FAQ_EDIT permissions to inject and store malicious JavaScript code within SVG files. When other users view these SVG files, the malicious script executes in their browsers, potentially leading to session hijacking, data theft, or other client-side impacts. The vulnerability does not affect availability and requires user interaction (clicking the SVG).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict FAQ_EDIT permissions to trusted users only and consider disabling SVG uploads if possible to reduce risk.