Medium severity6.1NVD Advisory· Published Apr 2, 2026· Updated Apr 7, 2026
CVE-2026-32629
CVE-2026-32629
Description
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 (quoted local part) yet contains raw HTML — for example "<script>alert(1)</script>"@evil.com. PHP's FILTER_VALIDATE_EMAIL accepts this email as valid. The email is stored in the database without HTML sanitization and later rendered in the admin FAQ editor template using Twig's |raw filter, which bypasses auto-escaping entirely. This issue has been patched in version 4.1.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
thorsten/phpmyfaqPackagist | < 4.1.1 | 4.1.1 |
phpmyfaq/phpmyfaqPackagist | < 4.1.1 | 4.1.1 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98gw-w575-h2phnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-98gw-w575-h2phghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-32629ghsaADVISORY
- github.com/thorsten/phpMyFAQ/releases/tag/4.1.1nvdProductWEB
News mentions
0No linked articles in our index yet.