GHSA-9525-27vj-c8r8 phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering

• Packagist thorsten/phpmyfaq: >= 4.1.1, < 4.1.2 → fixed in 4.1.2 • Packagist phpmyfaq/phpmyfaq: >= 4.1.1, < 4.1.2 → fixed in 4.1.2

Summary A stored XSS vulnerability in the comment rendering pipeline allows an authenticated user to inject JavaScript that executes for every visitor of an affected FAQ or News page. An attacker with a registered account can steal admin session cookies and take over the application. Details `Utils::parseUrl()` (`phpmyfaq/src/phpMyFAQ/Utils.php`, line 281) converts URLs in comment text into clickable `` tags at render time: $pattern = '/(https?:\/\/[^\s]+)/i'; $replacement = '$1'; return preg_replace($pattern, $replacement, $string); The regex `[^\s]+` matches `"` and ` ... The `"` closes the href attribute; onmouseover becomes a real attribute. Impact Stored XSS affecting all visitors of the page, including admins. Session cookie theft leads to full admin account takeover. The payload looks like a normal URL and persists until manually deleted.