EUVD-2026-280034

fkie_cve-2026-34729

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulnerability via Regex Bypass in Filter::removeAttributes(). This issue has been patched in version 4.1.1.

GHSA-cv2g-8cj8-vgc7 — phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()

Affected: Packagist: phpmyfaq/phpmyfaq

### Summary The sanitization pipeline for FAQ content is: 1. `Filter::filterVar($input, FILTER_SANITIZE_SPECIAL_CHARS)` — encodes `<`, `>`, `"`, `'`, `&` to HTML entities 2. `html_entity_decode($input, ENT_QUOTES | ENT_HTML5)` — decodes entities back to characters 3. `Filter::removeAttributes($input)` — removes dangerous HTML attributes

The `removeAttributes()` regex at line 174 only matches attributes with double-quoted values: ```php preg_match_all(pattern: '/[a-z]+=".+"/iU', subject: $html, matches: $attributes); ```

This regex does NOT match: - Attributes with single quotes: `onerror='alert(1)'` - Attributes without quotes: `onerror=alert(1)`

An attacker can bypass sanitization by submitting FAQ content with unquoted or single-quoted event handler attributes.

### Details

**Affected File:** `phpmyfaq/src/phpMyFAQ/Filter.php`, line 174

**Sanitization flow for FAQ question field:**

`FaqController::create()` lines 110, 145-149: ```php $question = Filter::filterVar($data->question, FILTER_SANITIZE_SPECIAL_CHARS); // ... ->setQuestion(Filter::removeAttributes(html_entity_decode( (string) $question, ENT_QUOTES | ENT_HTML5, encoding: 'UTF-8', ))) ```

**Template rendering:** `faq.twig` line 36: ```twig <h2 class="mb-4 border-bottom">{{ question | raw }}</h2> ```

**How the bypass works:**

1. Attacker submits: `<img src=x onerror=alert(1)>` 2. After `FILTER_SANITIZE_SPECIAL_CHARS`: `<img src=x onerror=alert(1)>` 3. After `html_entity_decode()`: `<img src…

Most recent entries from all

EUVD-2026-280034

fkie_cve-2026-34729

GHSA-cv2g-8cj8-vgc7 — phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()