CVE-2026-46360

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.

Summary

The SvgSanitizer::decodeAllEntities() method limits recursive entity decoding to 5 iterations. By wrapping each character of javascript in an href attribute value with 5 levels of & encoding around numeric HTML entities (e.g., j for j), an attacker can bypass both isSafe() detection and sanitize() removal. The uploaded SVG is served from the application origin with image/svg+xml content type, and the browser's XML parser fully decodes the remaining &#NNN; entities, resulting in a clickable javascript: link that executes arbitrary JavaScript.

Details

Root cause: decodeAllEntities() at phpmyfaq/src/phpMyFAQ/Helper/SvgSanitizer.php:223-249 limits entity decoding to maxIterations=5. Each iteration: (1) decodes &#NNN; numeric entities, (2) decodes &#xHH; hex entities, (3) calls html_entity_decode() which resolves one level of & → &. With 5 levels of & wrapping, all 5 iterations are consumed unwinding the & nesting, leaving the final &#NNN; numeric entities unresolved.

Code path:

1. Authenticated user with FAQ_EDIT permission uploads SVG via POST /admin/api/content/images (ImageController::upload() at line 39)
2. File extension is svg → SvgSanitizer::isSafe() called (line 114)
3. isSafe() calls decodeAllEntities() — 5 iterations resolve & nesting but leave ja... (numeric entities for javascript)
4. Pattern matching at line 47 (/href\s*=\s*["\'][\s]*javascript\s*:/i) does not match ja...
5. isSafe() returns true — file saved without any sanitization
6. SVG served directly by web server from content/user/images/ with image/svg+xml MIME type
7. Browser's XML parser decodes j → j, a → a, etc., reconstructing javascript:alert(document.domain)
8. User clicks the SVG link → JavaScript executes in the phpMyFAQ origin

The bypass is even simpler than initially described — no <script> decoy tag is needed. Since isSafe() itself is bypassed, the file is stored without sanitization and the sanitize() code path is never reached.

Relevant code in decodeAllEntities():

// phpmyfaq/src/phpMyFAQ/Helper/SvgSanitizer.php:223-249
private function decodeAllEntities(string $content): string
{
    $previous = '';
    $decoded = $content;
    $maxIterations = 5;  // <-- insufficient for 5 levels of &amp; + numeric entity

    while ($decoded !== $previous && $maxIterations-- > 0) {
        $previous = $decoded;
        // Step 1: Decode decimal entities (&#106; → j)
        $decoded = preg_replace_callback('/&#(\d+);/', ...);
        // Step 2: Decode hex entities (&#x6A; → j)
        $decoded = preg_replace_callback('/&#x([0-9a-fA-F]+);/', ...);
        // Step 3: Decode named HTML entities (&amp; → &)
        $decoded = html_entity_decode($decoded, ENT_QUOTES | ENT_HTML5, 'UTF-8');
    }
    // After 5 iterations with 5 &amp; levels: &#106; remains undecoded
    return preg_replace('/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/', '', $decoded);
}

PoC

Upload an SVG file containing a javascript: href where each character of javascript is entity-encoded with 5 levels of & nesting around numeric entities. No <script> decoy is required — isSafe() itself is bypassed.

Step 1: Create malicious SVG file (xss.svg):

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
  <a href="&amp;amp;amp;amp;amp;#106;&amp;amp;amp;amp;amp;#97;&amp;amp;amp;amp;amp;#118;&amp;amp;amp;amp;amp;#97;&amp;amp;amp;amp;amp;#115;&amp;amp;amp;amp;amp;#99;&amp;amp;amp;amp;amp;#114;&amp;amp;amp;amp;amp;#105;&amp;amp;amp;amp;amp;#112;&amp;amp;amp;amp;amp;#116;:alert(document.domain)">
    <circle cx="100" cy="100" r="80" fill="red"/>
    <text x="100" y="110" text-anchor="middle" fill="white" font-size="20">Click me</text>
  </a>
</svg>

Step 2: Upload via admin image upload endpoint:

curl -b…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-whqh-9pq5-c7r3. This link is maintained to preserve external references.

Original Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.

Summary

The SvgSanitizer::decodeAllEntities() method limits recursive entity decoding to 5 iterations. By wrapping each character of javascript in an href attribute value with 5 levels of & encoding around numeric HTML entities (e.g., j for j), an attacker can bypass both isSafe() detection and sanitize() removal. The uploaded SVG is served from the application origin with image/svg+xml content type, and the browser's XML parser fully decodes the remaining &#NNN; entities, resulting in a clickable javascript: link that executes arbitrary JavaScript.

Details

Root cause: decodeAllEntities() at phpmyfaq/src/phpMyFAQ/Helper/SvgSanitizer.php:223-249 limits entity decoding to maxIterations=5. Each iteration: (1) decodes &#NNN; numeric entities, (2) decodes &#xHH; hex entities, (3) calls html_entity_decode() which resolves one level of & → &. With 5 levels of & wrapping, all 5 iterations are consumed unwinding the & nesting, leaving the final &#NNN; numeric entities unresolved.

Code path:

1. Authenticated user with FAQ_EDIT permission uploads SVG via POST /admin/api/content/images (ImageController::upload() at line 39)
2. File extension is svg → SvgSanitizer::isSafe() called (line 114)
3. isSafe() calls decodeAllEntities() — 5 iterations resolve & nesting but leave ja... (numeric entities for javascript)
4. Pattern matching at line 47 (/href\s*=\s*["\'][\s]*javascript\s*:/i) does not match ja...
5. isSafe() returns true — file saved without any sanitization
6. SVG served directly by web server from content/user/images/ with image/svg+xml MIME type
7. Browser's XML parser decodes j → j, a → a, etc., reconstructing javascript:alert(document.domain)
8. User clicks the SVG link → JavaScript executes in the phpMyFAQ origin

The bypass is even simpler than initially described — no <script> decoy tag is needed. Since isSafe() itself is bypassed, the file is stored without sanitization and the sanitize() code path is never reached.

Relevant code in decodeAllEntities():

// phpmyfaq/src/phpMyFAQ/Helper/SvgSanitizer.php:223-249
private function decodeAllEntities(string $content): string
{
    $previous = '';
    $decoded = $content;
    $maxIterations = 5;  // <-- insufficient for 5 levels of &amp; + numeric entity

    while ($decoded !== $previous && $maxIterations-- > 0) {
        $previous = $decoded;
        // Step 1: Decode decimal entities (&#106; → j)
        $decoded = preg_replace_callback('/&#(\d+);/', ...);
        // Step 2: Decode hex entities (&#x6A; → j)
        $decoded = preg_replace_callback('/&#x([0-9a-fA-F]+);/', ...);
        // Step 3: Decode named HTML entities (&amp; → &)
        $decoded = html_entity_decode($decoded, ENT_QUOTES | ENT_HTML5, 'UTF-8');
    }
    // After 5 iterations with 5 &amp; levels: &#106; remains undecoded
    return preg_replace('/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/', '', $decoded);
}

PoC

Upload an SVG file containing a javascript: href where each character of javascript is entity-encoded with 5 levels of & nesting around numeric entities. No <script> decoy is required — isSafe() itself is bypassed.

Step 1: Create malicious SVG file (xss.svg):

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
  <a href="&amp;amp;amp;amp;amp;#106;&amp;amp;amp;amp;amp;#97;&amp;amp;amp;amp;amp;#118;&amp;amp;amp;amp;amp;#97;&amp;amp;amp;amp;amp;#115;&amp;amp;amp;amp;amp;#99;&amp;amp;amp;amp;amp;#114;&amp;amp;amp;amp;amp;#105;&amp;amp;amp;amp;amp;#112;&amp;amp;amp;amp;amp;#116;:alert(document.domain)">
    <circle cx="100" cy="100" r="80" fill="red"/>
    <text x="100" y="110" text-anchor="middle" fill="white" font-size="20">Click me</text>
  </a>
</svg>

Step 2: Upload via admin image upload endpoint:

curl -b…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-whqh-9pq5-c7r3. This link is maintained to preserve external references.

Original Description

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.