This vulnerability allows an authenticated user with FAQ_EDIT rights to embed malicious SVG files that bypass a depth‑limit check in the SvgSanitizer component, resulting in stored cross‑site scripting. The attacker can use deeply nested ampersand encodings around numeric HTML entities to reconstruct javascript: URLs that are executed when another user opens the SVG. The flaw is a classic client‑side flaw identified as CWE‑79, exposing affected users to arbitrary script execution in the browser, potentially leading to session hijacking, credential theft or defacement.

Affected systems include the phpMyFAQ content‑management solution from thorsten with any version earlier than 4.1.2. Users running these releases cannot avoid the vulnerable sanitization logic, and anyone able to add entries to the FAQ can insert otherwise sanitized code into the database and serve it to visitors.

Risk assessment shows a CVSS score of 5.4, indicating moderate severity. No EPSS score is recorded, and the vulnerability does not appear in the CISA KEV list. Exploitability requires that the attacker possess authenticated FAQ_EDIT privileges, but otherwise there are no additional prerequisites, so the flaw can be leveraged inside trusted editor accounts to persistently deliver malicious script to other users.