Cloudanix VulnDB

GHSA-whqh-9pq5-c7r3

Medium · 5.4

phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

CVSS

5.4

EPSS

—

Published

May 6, 2026

CISA due date

—

The record

The `SvgSanitizer::decodeAllEntities()` method limits recursive entity decoding to 5 iterations. By wrapping each character of `javascript` in an `href` attribute value with 5 levels of `&` encoding around numeric HTML entities (e.g., `j` for `j`), an attacker can bypass both `isSafe()` detection and `sanitize()` removal. The uploaded SVG is served from the application origin with `image/svg+xml` content type, and the browser's XML parser fully decodes the remaining `&#NNN;` entities, resulting in a clickable `javascript:` link that executes arbitrary JavaScript.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities