https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T13:23:28.610728+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-322434 EUVD-2026-322434 2026-10-19T13:23:28.612782+00:00 EUVD-2026-322434 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46361 fkie_cve-2026-46361 2026-10-19T13:23:28.612815+00:00

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filter, disabling autoescape protection. Attackers with FAQ editor privileges can inject HTML-entity-encoded payloads that bypass html_entity_decode(strip_tags()) processing in SearchController.php, executing arbitrary JavaScript in every visitor's browser context including administrators.

 https://cve.radiocsirt.org/vuln/ghsa-pqh6-8fxf-jx22 GHSA-pqh6-8fxf-jx22 — phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rend… 2026-10-19T13:23:28.612847+00:00

Affected: Packagist: phpmyfaq/phpmyfaq, Packagist: thorsten/phpmyfaq

## Summary

The search result rendering template (`search.twig`) outputs FAQ content fields `result.question` and `result.answerPreview` using Twig's `| raw` filter, which completely disables the template engine's built-in auto-escaping.

A user with FAQ editor/contributor privileges can store a payload encoded as HTML entities. During search result construction, `html_entity_decode(strip_tags(...))` restores the raw HTML tags — bypassing `strip_tags()` — and the restored payload is injected into every visitor's browser via the `| raw` output.

This vulnerability is distinct from GHSA-cv2g-8cj8-vgc7 (affects `faq.twig`, bypass via regex mismatch in `Filter::removeAttributes()`) and is not addressed by the 4.1.1 patch.

---

## Affected Files

| File | Location | Issue | |---|---|---| | `phpmyfaq/assets/templates/default/search.twig` | lines rendering `result.question`, `result.answerPreview` | `(Vertical Bar) raw` disables autoescape | | `phpmyfaq/src/phpMyFAQ/Controller/Api/SearchController.php` | search result processing loop | `html_entity_decode(strip_tags(...))` restores encoded payloads | | `phpmyfaq/src/phpMyFAQ/Search.php` | `logSearchTerm()` | No HTML sanitization on stored search term (secondary, preventive) |

---

## Details

### Vulnerability A (Primary): `search.twig` — `| raw` Disables Autoescape

**File:** `phpmyfaq/assets/templates/default/search.twig`

```twig <a title="Test" href="{{ result.url }}">{{ result.question | raw }}</a> <small class="small">{{ r…