How severe is GHSA-9525-27vj-c8r8?

GHSA-9525-27vj-c8r8 has a CVSS score of 7.6/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by GHSA-9525-27vj-c8r8?

GHSA-9525-27vj-c8r8 affects the following packages: thorsten/phpmyfaq (Packagist), phpmyfaq/phpmyfaq (Packagist). Ecosystems affected: Packagist.

How do I fix GHSA-9525-27vj-c8r8?

Update thorsten/phpmyfaq to 4.1.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-9525-27vj-c8r8 is resolved across your whole dependency graph.

How do I detect GHSA-9525-27vj-c8r8 in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for thorsten/phpmyfaq. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-9525-27vj-c8r8 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-9525-27vj-c8r8?

O3 pinpoints whether GHSA-9525-27vj-c8r8 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-9525-27vj-c8r8 actively exploited in the wild?

No public exploit code has been indexed for GHSA-9525-27vj-c8r8 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What type of vulnerability is GHSA-9525-27vj-c8r8?

GHSA-9525-27vj-c8r8 is classified as Cross-site Scripting (XSS) (CWE-79). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was GHSA-9525-27vj-c8r8 published, and has it been updated?

GHSA-9525-27vj-c8r8 was published on May 6, 2026 and was last updated on June 9, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘 Packagist

GHSA-9525-27vj-c8r8

HIGH

GHSA-9525-27vj-c8r8 is a high-severity (CVSS 7.6) Cross-site Scripting (XSS) vulnerability in thorsten/phpmyfaq. O3 Security confirms whether GHSA-9525-27vj-c8r8 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering

Also known asCVE-2026-46367

Published

May 6, 2026

Updated

Jun 9, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Blast Radius

2 pkgs affected

🐘thorsten/phpmyfaq🐘phpmyfaq/phpmyfaq

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

A stored XSS vulnerability in the comment rendering pipeline allows an authenticated user to inject JavaScript that executes for every visitor of an affected FAQ or News page. An attacker with a registered account can steal admin session cookies and take over the application.

Details

Utils::parseUrl() (phpmyfaq/src/phpMyFAQ/Utils.php, line 281) converts URLs in comment text into clickable <a> tags at render time:

$pattern = '/(https?:\/\/[^\s]+)/i';
$replacement = '<a href="$1">$1</a>';
return preg_replace($pattern, $replacement, $string);

The regex [^\s]+ matches " and <, and the URL is inserted into the href attribute with no htmlspecialchars() call. A URL with a literal " closes the attribute early and allows injecting event handlers like onmouseover.

This only reaches the sink when main.enableCommentEditor is enabled. In that path, comment text goes through sanitizeHtmlComment() instead of FILTER_SANITIZE_SPECIAL_CHARS — which encodes " — so the double-quote survives to storage. The comment is then passed through parseUrl() and rendered via {{ comment.comment|raw }} in comment.macros.twig (line 40), which disables Twig auto-escaping.

The same sink exists in the admin comment panel (admin/content/comments.twig, lines 62 and 112), so admins viewing the panel are also affected.

No Content-Security-Policy headers are set anywhere in the app.

PoC

Requirements:

main.enableCommentEditor = true (set in admin Configuration panel)
attacker has any registered user account
one FAQ entry with comments allowed exists

Steps:

Log in as a registered user and open a FAQ with comments.
Submit the following as the comment text:
```
https://www.evil.com/"onmouseover="alert(document.cookie)
```
(www. prefix required — parseUrl strips https:// then only re-adds it for www. URLs, which is what triggers the linkification)
Any user who views that FAQ page and hovers the link triggers the payload. To hit an admin, wait for them to visit the page or check the admin comments panel at /admin/content/comments.

Resulting HTML in the page:

<a href="https://www.evil.com/"onmouseover="alert(document.cookie)">
  ...
</a>

The " closes the href attribute; onmouseover becomes a real attribute.

Impact

Stored XSS affecting all visitors of the page, including admins. Session cookie theft leads to full admin account takeover. The payload looks like a normal URL and persists until manually deleted.

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`thorsten/phpmyfaq`	≥ 4.1.1&&< 4.1.2	4.1.2
🐘Packagist	`phpmyfaq/phpmyfaq`	≥ 4.1.1&&< 4.1.2	4.1.2

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for thorsten/phpmyfaq. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update thorsten/phpmyfaq to 4.1.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-9525-27vj-c8r8 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-9525-27vj-c8r8 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-9525-27vj-c8r8. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary A stored XSS vulnerability in the comment rendering pipeline allows an authenticated user to inject JavaScript that executes for every visitor of an affected FAQ or News page. An attacker with a registered account can steal admin session cookies and take over the application. ### Details `Utils::parseUrl()` (`phpmyfaq/src/phpMyFAQ/Utils.php`, line 281) converts URLs in comment text into clickable `<a>` tags at render time: $pattern = '/(https?:\/\/[^\s]+)/i'; $replacement = '<a href="$1">$1</a>'; return preg_replace($pattern, $replacement, $string); The regex `[^\s

O3 Security · Impact-Aware SCA

Is GHSA-9525-27vj-c8r8 in your dependencies?

O3 detects GHSA-9525-27vj-c8r8 across Packagist dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works