What is GHSA-4fcw-x9vq-q4pp?

GHSA-4fcw-x9vq-q4pp is a security advisory published by GitHub Security Advisories with Medium severity. phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in...

Which CVE IDs does GHSA-4fcw-x9vq-q4pp cover?

GHSA-4fcw-x9vq-q4pp covers the following CVE IDs: CVE-2026-111903. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4fcw-x9vq-q4pp?

GHSA-4fcw-x9vq-q4pp has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-4fcw-x9vq-q4ppMediumCVSS 5.4

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in...

Vendor

GitHub Security Advisories

Published

October 17, 2026

Last Modified

October 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-111903 →

📋 Description

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when viewers click it to hijack admin sessions.

🔗 References (4)

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3v5-p957-w6gq
https://nvd.nist.gov/vuln/detail/CVE-2026-111903
https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-stored-xss-via-svg-dtd-entity-bypass
https://github.com/advisories/GHSA-4fcw-x9vq-q4pp