Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue in the phpMyFAQ application, specifically within the SVG sanitization process. The root cause lies in the phpMyFAQ\Helper\SvgSanitizer::decodeAllEntities function. This function is responsible for decoding HTML entities within an SVG file to identify and remove malicious content. However, it limits the decoding process to a maximum of 5 recursive iterations.
An attacker can exploit this by crafting a malicious SVG file containing a javascript: URL in an attribute like href. The attacker would encode the characters of "javascript" using multiple layers of HTML entities (e.g., j for 'j'). Since the number of encoding layers is greater than the sanitizer's decoding depth, the decodeAllEntities function will exhaust its iterations before the payload is fully decoded.
The phpMyFAQ\Helper\SvgSanitizer::isSafe function, which relies on decodeAllEntities, will therefore fail to detect the malicious javascript: string and will incorrectly flag the SVG file as safe.
The attack is initiated when an authenticated user with FAQ_EDIT permissions uploads this malicious SVG file through the endpoint handled by phpMyFAQ\Controller\Administration\Api\ImageController::upload.
When another user views the uploaded SVG, the browser's XML parser, which does not have the same decoding limitation, will fully process the nested entities. This reconstructs the malicious javascript: URL, which then executes in the context of the user's browser and the phpMyFAQ application's domain, leading to a stored XSS attack.
The fix applied in version 4.1.2 involved two main changes. The most direct mitigation was to remove support for SVG file uploads entirely, as seen in the modification to ImageController::upload. Additionally, the custom and vulnerable sanitization logic, including the SvgSanitizer class, was replaced with the more robust Symfony HTML Sanitizer component.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpMyFAQ/phpMyFAQ | composer | < 4.1.2 | 4.1.2 |
| thorsten/phpMyFAQ | composer | < 4.1.2 | 4.1.2 |
