CVE-2026-34729
published 2026-04-02CVE-2026-34729: phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulnerability via Regex Bypass in Filter::removeAttributes()…
PriorityP420medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.24%
15.1th percentile
phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulnerability via Regex Bypass in Filter::removeAttributes(). This issue has been patched in version 4.1.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| phpmyfaq | phpmyfaq | < 4.1.1 | 4.1.1 |
| phpmyfaq | phpmyfaq | >= 0 < 4.1.1 | 4.1.1 |
| thorsten | phpmyfaq | < 4.1.1 | 4.1.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
osv·2026-04-01
CVE-2026-34729 [MEDIUM] phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
### Summary
The sanitization pipeline for FAQ content is:
1. `Filter::filterVar($input, FILTER_SANITIZE_SPECIAL_CHARS)` — encodes ``, `"`, `'`, `&` to HTML entities
2. `html_entity_decode($input, ENT_QUOTES | ENT_HTML5)` — decodes entities back to characters
3. `Filter::removeAttributes($input)` — removes dangerous HTML attributes
The `removeAttributes()` regex at line 174 only matches attributes with double-quoted values:
```php
preg_match_all(pattern: '/[a-z]+=".+"/iU', subject: $html, matches: $attributes);
```
This regex does NOT match:
- Attributes with single quotes: `onerror='alert(1)'`
- Attributes without quotes: `onerror=alert(1)`
An attacker can bypass sanitization by submitting FAQ content with unquoted or
GHSA
phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
ghsa·2026-04-01
CVE-2026-34729 [MEDIUM] CWE-79 phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()
### Summary
The sanitization pipeline for FAQ content is:
1. `Filter::filterVar($input, FILTER_SANITIZE_SPECIAL_CHARS)` — encodes ``, `"`, `'`, `&` to HTML entities
2. `html_entity_decode($input, ENT_QUOTES | ENT_HTML5)` — decodes entities back to characters
3. `Filter::removeAttributes($input)` — removes dangerous HTML attributes
The `removeAttributes()` regex at line 174 only matches attributes with double-quoted values:
```php
preg_match_all(pattern: '/[a-z]+=".+"/iU', subject: $html, matches: $attributes);
```
This regex does NOT match:
- Attributes with single quotes: `onerror='alert(1)'`
- Attributes without quotes: `onerror=alert(1)`
An attacker can bypass sanitization by submitting FAQ content with unquoted or
No detection rules found.
No public exploits indexed.
2026-04-02
Published