Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue in phpMyFAQ versions prior to 4.1.2. It exists in the FAQ creation and update functionalities. The root cause is an improper sanitization process that can be bypassed using an encode-decode cycle.
When a user creates or updates an FAQ, the input for the 'question' and 'answer' fields is processed in phpMyFAQ\Controller\FaqController. The application first uses FILTER_SANITIZE_SPECIAL_CHARS (via Filter::filterVar), which HTML-encodes special characters like < and >. However, it then immediately uses html_entity_decode(), which reverses the encoding. This decoded input is then passed to phpMyFAQ\Filter::removeAttributes. This function was designed to only strip HTML attributes, not the tags themselves. Consequently, malicious HTML tags like <script> were not removed and were stored in the database.
When the FAQ is displayed, the content is rendered using the |raw filter in the Twig templates (faq.twig and search.twig), which disables Twig's default output escaping. This causes the stored malicious script to be executed in the browser of any user viewing the FAQ.
The fix, identified in commit 79da5ecf051d4ddaa527a7a1e80a7b72175057a0, was to replace the inadequate custom implementation of phpMyFAQ\Filter::removeAttributes with Symfony's HtmlSanitizer component. This new sanitizer properly removes dangerous tags and attributes, effectively mitigating the XSS vulnerability.
The primary vulnerable function is phpMyFAQ\Filter::removeAttributes because it contained the flawed sanitization logic. The controller methods phpMyFAQ\Controller\FaqController::create and phpMyFAQ\Controller\FaqController::update are the entry points that orchestrate the vulnerable sequence of operations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpMyFAQ/phpMyFAQ | composer | < 4.1.2 | 4.1.2 |
| thorsten/phpMyFAQ | composer | < 4.1.2 | 4.1.2 |
