A regex-based SVG sanitizer in phpMyFAQ can be bypassed using HTML entity encoding inside javascript: URLs within SVG <a href> attributes. This allows an attacker who can upload an SVG as an editor to execute arbitrary JavaScript in the context of FAQ viewers, leading to stored cross‑site scripting and a privilege escalation from editor to administrator.

The vulnerability affects the open source FAQ application phpMyFAQ (developed by thorsten) prior to version 4.1.1. Versions 4.1.1 and later contain the patch that fixes the sanitizer bypass.

The flaw has a CVSS score of 5.4, indicating moderate severity, and an EPSS score of less than 1%, suggesting low likelihood of exploitation. It is not listed in CISA’s KEV catalog. An attacker must be able to upload SVG content with edit_faq permission, meaning the attack vector is an authenticated internal attacker. When successful, the attacker can run arbitrary code and elevate privileges to full administrator.