CVE-2026-34974: phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation

April 1, 2026 (updated April 6, 2026)

The regex-based SVG sanitizer in phpMyFAQ (SvgSanitizer.php) can be bypassed using HTML entity encoding in javascript: URLs within SVG <a href> attributes. Any user with edit_faq permission can upload a malicious SVG that executes arbitrary JavaScript when viewed, enabling privilege escalation from editor to full admin takeover.

References

github.com/advisories/GHSA-5crx-pfhq-4hgg
github.com/thorsten/phpMyFAQ
github.com/thorsten/phpMyFAQ/releases/tag/4.1.1
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-5crx-pfhq-4hgg
nvd.nist.gov/vuln/detail/CVE-2026-34974

Code Behaviors & Features

Detect and mitigate CVE-2026-34974 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →