\"@evil.com. PHP's FILTER_VALIDAT","inLanguage":"en-US","identifier":"CVE-2026-32629","datePublished":"2026-04-02T15:16:38.017","dateModified":"2026-10-26T21:10:00.170","about":{"@type":"Thing","name":"CVE-2026-32629","identifier":"CVE-2026-32629"},"isPartOf":{"@type":"WebSite","name":"GotRooted","url":"https://gotrooted.org/"},"publisher":{"@type":"Organization","name":"GotRooted","logo":{"@type":"ImageObject","url":"https://gotrooted.org/logo.png","width":640,"height":640}}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://gotrooted.org/"},{"@type":"ListItem","position":2,"name":"cve","item":"https://gotrooted.org/cve"},{"@type":"ListItem","position":3,"name":"CVE 2026 32629","item":"https://gotrooted.org/cve/CVE-2026-32629"}]}]}

VULNERABILITY INTELLIGENCE

CVE-2026-32629

CVSS score6.1 MEDIUM
EPSS probability0.27%
CISA KEVNot currently listed
Published2026-04-02
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 (quoted local part) yet contains raw HTML — for example "<script>alert(1)</script>"@evil.com. PHP's FILTER_VALIDATE_EMAIL accepts this email as valid. The email is stored in the database without HTML sanitization and later rendered in the admin FAQ editor template using Twig's |raw filter, which bypasses auto-escaping entirely. This issue has been patched in version 4.1.1.

Weakness classification

  • security-advisories@github.com: CWE-20
  • nvd@nist.gov: CWE-79

Primary references