CVE-2026-46360 | thorsten phpMyFAQ up to 4.1.1 SVG File decodeAllEntities cross site scripting (GHSA-whqh-9pq5-c7r3)

A vulnerability described as problematic has been identified in thorsten phpMyFAQ up to 4.1.1. The impacted element is the function SvgSanitizer::decodeAllEntities of the component SVG File Handler. Such manipulation leads to cross site scripting.

This vulnerability is referenced as CVE-2026-46360. It is possible to launch the attack remotely. No exploit is available.

Upgrading the affected component is recommended.