---
id: CVE-2026-111903
title: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass
summary: >-
  phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting
  vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to
  bypass sanitization using XML DTD custom entities. Attackers can upload an SVG
  defi…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: thorsten
product: phpMyFAQ
affected:
  - phpMyFAQ >= 4.2.0-alpha < 4.2.0-beta
published: '2026-10-17'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T18:46:23.442Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111903'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3v5-p957-w6gq
    label: GitHub Security Advisory (GHSA-j3v5-p957-w6gq)
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-dtd-entity-bypass
    label: >-
      VulnCheck Advisory: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via
      SVG DTD Entity Bypass
tags:
  - cve.org
ingestedAt: '2026-10-17T19:08:56.877Z'
---

## Overview

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.

## Affected

- `phpMyFAQ >= 4.2.0-alpha < 4.2.0-beta`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.