PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46363 thorsten CVE debrief

CVE-2026-46363 is a medium-severity stored cross-site scripting issue in phpMyFAQ before 4.1.2. Authenticated users with FAQ_ADD permission can inject malicious content through FAQ create/update paths, and the payload can persist until it is rendered to other users.

Vendor
thorsten
Product
phpmyfaq
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-28
Advisory published
2026-05-15
Advisory updated
2026-05-28

Who should care

Administrators and developers running phpMyFAQ, especially teams that allow non-admin users to create or edit FAQ content. Security teams should also review any deployment that renders user-controlled FAQ fields to the browser.

Technical summary

The issue is a stored XSS vulnerability (CWE-79) in FAQ creation and update flows. According to the provided description and NVD metadata, the attack requires authentication and FAQ_ADD permission, uses question or answer parameters, and bypasses sanitization through encode-decode cycles. When the affected FAQ content is later rendered with a raw Twig filter, the injected script executes in visitors' browsers. The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting network reachability, low attack complexity, low required privileges, and user interaction.

Defensive priority

Medium. The CVSS score is moderate, but the impact is persistent and browser-side, so teams using phpMyFAQ should patch promptly and review any workflow that allows authenticated content creation.

Recommended defensive actions

  • Upgrade phpMyFAQ to 4.1.2 or later.
  • Review FAQ entries created or modified by accounts with FAQ_ADD permission for unexpected script content or other untrusted markup.
  • Restrict FAQ_ADD permission to the smallest practical set of trusted users.
  • Audit the FAQ rendering path to ensure user-controlled fields are escaped and not passed through raw template rendering.
  • Check for other pages or templates that reuse the same FAQ content fields and may inherit the same exposure.
  • Monitor logs and recent content changes for suspicious FAQ creation or update activity.

Evidence notes

The supplied description states that phpMyFAQ before 4.1.2 is affected by a stored XSS that bypasses sanitization through encode-decode cycles and executes when rendered with a raw Twig filter. NVD metadata lists CWE-79 and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The provided NVD source record shows vulnStatus as Deferred. PublishedAt is 2026-05-15T19:17:03.633Z and ModifiedAt is 2026-05-18T17:25:39.493Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46363 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46363

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46363 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46363

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.