GHSA-jv8r-hv7q-p6vc

### Summary A stored cross-site scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose **display name** contains HTML entities (e.g., `&lt;img ...&gt;`). When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. ### Details Root cause is the following chain: - **User-controlled input stored**: attacker-provided `display_name` (real name) is stored in DB (often as HTML entities, e.g., `&lt;img ...&gt;`). - **Decode on read**: `phpmyfaq/src/phpMyFAQ/User/UserData.php` decodes `display_name` using `html_entity_decode(...)` (“for backward compatibility”). - **Unsafe sink**: admin user list renders the decoded value unescaped using Twig `|raw`: - `phpmyfaq/assets/templates/admin/user/users.twig` (users table uses `{{ user.display_name|raw }}`) As a result, an entity-encoded payload becomes active HTML/JS when rendered in the admin user list. Note: This report is about the `display_name` field + entity-decoding path. It is distinct from previously published issues focused on the `email` field. ### PoC (minimal reproduction) **Preconditions / configuration** - Registration enabled (`security.enableRegistration = true`). - Attacker does not need admin privileges. - Admin must view the admin user list page. **Steps** 1. As an unauthenticated user, open the registration page and create a new account. 2. Set the **display name / real name** field to the following entity-encoded payload: - `&lt;img src=x onerror=alert(1)&gt;` 3. Complete registration. 4. As an administrator, open the admin user list (example): - `http://127.0.0.1:8080/admin/user/list` 5. Observe JavaScript execution in the admin’s browser (e.g., `alert(1)` triggers) and the payload is rendered as an actual `<img>` element. ### Impact Stored XSS in the admin context can enable: - admin session compromise (depending on cookie flags), - CSRF token exfiltration and privileged admin actions, - UI redress/phishing within the admin panel. ### Evidence (what I observed) - Stored DB value (entities): `&lt;img src=x onerror=alert(1)&gt;` - Rendered HTML in admin user list: `<img src="x" onerror="alert(1)">` ### Affected versions **Confirmed by code inspection** - 4.0.14 - 4.0.15 - Both contain `html_entity_decode` for `display_name` in `UserData.php` and `{{ user.display_name|raw }}` in `users.twig`. **Confirmed by live reproduction** - 4.1.0-RC (tested on current source checkout) ### Environment (tested) - Host OS: macOS 15.6.1 (24G90) - Web container OS: Debian GNU/Linux 12 (bookworm) - PHP: 8.4.5RC1 - DB: MariaDB 11.6.2 - phpMyFAQ source commit (tested): bca1c4192c2ad61a3595b4289d9551a51e0e9848 ### Contact / Credit - Contact: [email protected]