Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Description
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
thorsten/phpmyfaqPackagist | < 3.1.12 | 3.1.12 |
Affected products
2- thorsten/thorsten/phpmyfaqv5Range: unspecified
Patches
Vulnerability mechanics
Root cause
"The absence of a Content Security Policy (CSP) in the HTML5 export generation allows for the execution of malicious scripts."
Attack vector
An attacker can trigger this vulnerability by injecting malicious scripts into content that is subsequently processed by the HTML5 export feature. When a user views the exported HTML5 file, the injected script executes in the context of the user's browser. This is a form of stored XSS where the lack of restrictive security headers allows the execution of unauthorized code [patch_id=24088].
Affected code
The vulnerability is located in `phpmyfaq/src/phpMyFAQ/Export/Html5.php`. The `generate` method fails to implement a Content Security Policy (CSP) for generated HTML5 exports, leaving the output susceptible to stored Cross-Site Scripting (XSS) [patch_id=24088].
What the fix does
The patch modifies `phpmyfaq/src/phpMyFAQ/Export/Html5.php` to include a Content-Security-Policy (CSP) meta tag within the head section of the generated HTML5 output [patch_id=24088]. By setting the policy to `default-src 'self'; img-src https://*; child-src 'none';`, the fix restricts the sources from which content can be loaded and prevents the execution of unauthorized inline scripts. This mitigates the risk of stored XSS by enforcing stricter browser security controls on the exported files [patch_id=24088].
Preconditions
- configThe application must be running a version of phpmyfaq prior to 3.1.12.
Generated on May 11, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4News mentions
0No linked articles in our index yet.