The vulnerability is a stored cross‑site scripting flaw located in the SvgSanitizer component of phpMyFAQ 4.2.0‑alpha through just before 4.2.0‑beta. Attackers who can upload images with FAQ_EDIT permission can embed a custom XML DTD entity inside an SVG file. When the entity is expanded it creates JavaScript in an <a href> element. An administrator later viewing or previewing the malicious SVG will trigger the script, allowing the attacker to hijack the admin session or execute arbitrary scripts in the privileged context.

The affected product is the phpMyFAQ web‑based FAQ software (vendor thorsten). Versions 4.2.0‑alpha up to, but not including, 4.2.0‑beta are vulnerable. No other versions or operating system combinations are listed, so the impact is confined to installations using these specific release numbers.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that the attack vector requires a user with FAQ_EDIT permission to upload a malicious SVG, which then triggers the flaw when an administrator later opens or previews the file. Because the flaw permits arbitrary script execution in the context of a privileged user, the potential impact for a targeted attacker is significant, despite the moderate CVSS. No public exploitation reports are available at this time, but the risk to high‑value targets remains.