CVE-2026-46367 thorsten CVE debrief

Who should care

Administrators and security teams running phpMyFAQ, especially deployments that allow authenticated users to submit comments or other content that is rendered back to visitors. Teams responsible for web application hardening, session protection, and content sanitization should prioritize review.

Technical summary

The supplied NVD data describes a stored XSS in phpMyFAQ, affecting versions before 4.1.2, with CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. The issue is attributed to Utils::parseUrl() in comment rendering. The attacker needs low-privilege authenticated access, then can place a maliciously formed URL containing unescaped quotes so that JavaScript is stored and executed in a viewer's browser. The impact is strongest where privileged users such as administrators view impacted FAQ pages. The source record is currently marked Deferred in NVD, but the referenced advisories identify the issue as phpMyFAQ and point to a fix boundary at 4.1.2.

Defensive priority

High. This is a network-reachable stored XSS that requires authentication and user interaction, but it can lead to cross-user compromise and administrative session abuse. Prioritize patching and validation of any instance that accepts user-generated content.

Recommended defensive actions

• Upgrade phpMyFAQ to 4.1.2 or later.
• Review comment and URL rendering paths that rely on Utils::parseUrl().
• Verify that output encoding and HTML attribute handling are applied consistently to user-controlled content.
• Limit who can submit comments or other user-generated content until patched.
• Check for unusual comment content containing malformed URLs, quotes, or injected event handlers.
• Protect administrator sessions with strong session controls and shortest-necessary privileges.
• Re-test affected pages after patching to confirm the stored payload is no longer rendered as active script.

Evidence notes

The description provided with the CVE says phpMyFAQ before 4.1.2 contains a stored XSS in Utils::parseUrl() that lets authenticated users inject JavaScript via malformed URLs in comments. The NVD metadata lists CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N and CWE-79, and marks the record Deferred. The referenced advisory links point to a GitHub security advisory and a VulnCheck advisory for phpMyFAQ, which supports the product attribution despite the vendor metadata needing review.

Official resources