Security Advisory 2026-08-20
Multiple vulnerabilities in phpMyFAQ
- Issued on:
- 2026-08-20
- Software:
- phpMyFAQ <= 4.1.7
- Risk:
- High
- Platforms:
- all
The phpMyFAQ Team has learned of security issues that'd been discovered in phpMyFAQ 4.1.7 and earlier.
Description
High severity
When the WYSIWYG editor is enabled for the frontend, a FAQ submitted by an unauthenticated visitor is stripped of HTML tags but not of HTML entities, which are decoded back into executable HTML afterwards. The administration FAQ editor renders this content unsanitized, so the injected script executes in the administrator's browser when the submission is reviewed, allowing session theft and admin account takeover.
Two-factor authentication can be disabled with only a valid session and CSRF token, without re-entering the password or a one-time code, so an attacker with temporary access to a logged-in session can permanently remove the second factor from the account.
The user control panel API changes the account password without verifying the current password, so an attacker with temporary access to a logged-in session can take over the account permanently.
Moderate severity
The chat user search escapes SQL string syntax but not the LIKE wildcards % and _, so any authenticated user can bypass the intended display-name filter and enumerate the active users of an installation.
The CAPTCHA on the anonymous question form is not validated when the request is submitted with the store=now parameter, allowing automated spam submissions.
Incorrect permission checks on the news editing and FAQ translation pages in the administration disclose drafts and inactive content to users without the corresponding permissions.
The user data export ZIP includes the live TOTP secret, so anyone who obtains the export can generate valid second factors for the account.
The admin dashboard API endpoints for searches and content health only require a login instead of the corresponding permission, so any authenticated user can read this data.
FAQ rendering reverses sanitization with html_entity_decode(), turning previously escaped markup back into executable HTML and allowing stored cross-site scripting.
Low severity
Guests can submit questions even when allowQuestionsForGuests is disabled, as long as the ask-questions feature is enabled.
Solution
The phpMyFAQ Team has released the new phpMyFAQ version 4.1.8, which fixes the vulnerabilities. All users of affected phpMyFAQ versions are encouraged to upgrade as soon as possible to this latest version. The fixes are also included in phpMyFAQ 4.2.0-alpha.2.
Workaround
There's no workaround except installing phpMyFAQ 4.1.8.
Thanks
The phpMyFAQ team would like to thank JosanGeorge, proochicken, skeletonsec, and pavelkohout396 for the responsible disclosures of these vulnerabilities.