The bug is a stored XSS flaw in the SvgSanitizer component of phpMyFAQ. By uploading an SVG file that contains script elements whose tags are broken around characters that the sanitizer removes, the single‑pass sanitization reassembles the tags when the image is displayed, causing the embedded script to run in the context of the application. Attackers who can act as FAQ editors can thus store malicious SVG that will execute arbitrary JavaScript in any viewer’s browser.

The issue affects the phpMyFAQ content‑management system from Thorsten. All releases from 4.2.0‑alpha up to but not including 4.2.0‑beta are vulnerable.

The CVSS score of 5.1 marks the flaw as a medium‑severity issue. No EPSS score is available and it is not listed in CISA’s KEV catalog, indicating a moderate probability of real‑world exploitation. The attacker needs editor privileges to upload a malicious file or must persuade a user to open the SVG. When the SVG is rendered, the injected script runs with the application origin, allowing in‑browser payload execution but not allowing arbitrary system access. The attack surface is thus limited to users who view the file, but the impact on confidentiality and integrity of the application session can be significant.