A bypass of the SVG sanitizer that relies on regex patterns allows an attacker to embed malicious JavaScript in a stored SVG file by using HTML entity encoding inside a javascript: URL within an SVG <a href> attribute. The vulnerability is exploited when a user with edit_faq permission uploads the crafted SVG, which is later displayed to any user. This results in stored cross‑site scripting that enables the attacker to execute arbitrary code in the context of the web application and elevate their privileges from a regular editor to a full administrator.

phpMyFAQ, the open source FAQ web application, is affected in all releases prior to version 4.1.1. Users running any version earlier than 4.1.1 and who have the ability to edit or upload FAQ content have a direct attack surface.

The CVSS score of 5.4 indicates moderate severity. EPSS data is not available, and the issue is not indexed in CISA’s KEV catalog. The attack is confined to authorized users who can edit FAQ entries; however, once a malicious SVG is uploaded, any visitor to the FAQ page can trigger the payload, resulting in a privilege escalation to administrator level. The vulnerability is mitigated by applying the patch released in 4.1.1, thereby eliminating the sanitizer bypass and preventing stored XSS.