CVE-2026-111894 thorsten CVE debrief

Who should care

Defenders responsible for phpMyFAQ installations, content authors, and users of the affected versions should be aware of this vulnerability and take necessary actions to prevent exploitation.

Why it matters

CVE-2026-111894 is a stored cross-site scripting vulnerability in phpMyFAQ that allows authenticated content authors to inject JavaScript, potentially leading to phishing interfaces or top-frame redirects for viewers. Defenders should prioritize verifying and updating phpMyFAQ installations to prevent exploitation.

• Phishing interfaces can be run for viewers through injected JavaScript
• Top-frame redirects can be executed for viewers through injected JavaScript
• Content authors can inject JavaScript in FAQ or News content
• The vulnerability allows bypassing the hostless media-host allowlist

Technical summary

The vulnerability exists in phpMyFAQ versions 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. Authenticated content authors can inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. The vulnerability allows bypassing the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers.

Defensive priority

Defenders should prioritize verifying and updating phpMyFAQ installations to prevent exploitation.

Recommended defensive actions

• Verify phpMyFAQ version and update to a fixed version if necessary
• Restrict content author permissions to prevent JavaScript injection
• Monitor FAQ and News content for suspicious iframes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation and affected versions is limited. Defenders should verify phpMyFAQ installations, review content author permissions, and monitor FAQ and News content for suspicious iframes. The vulnerability allows bypassing the hostless media-host allowlist in FaqHelper::cleanUpContent(), which is rendered via Twig's raw filter, to run phishing interfaces or top-frame redirects for viewers. Evidence is limited, and defenders should exercise

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.