Root cause
Injection & unsafe execution introduced
The data accessor decodes HTML entities in the stored display name.
phpMyFAQ decoded stored display names that the administrator user list rendered without escaping. The repair restores template escaping for display names.
How AI contributed: Direct introductionPublished Dec 29, 2025 in 
thorsten/phpmyfaqAll 2 findings in this repository
Provisional finding. Full causal and release verification remains incomplete.
Fix
Security fix
The user-list template removes the raw filter so display names receive normal escaping.
Case facts
- CVE ID
- CVE-2025-68951
- GHSA ID
- GHSA-JV8R-HV7Q-P6VC
- Published
- Dec 29, 2025
- Severity
- medium
- Language
- PHP
- AI tool
GitHub Copilot- AI role
- Direct introduction
- Vulnerable release
- >= 4.0.14, < 4.0.16
- Fixed release
- 4.0.16
AI-assisted change
AI-assisted changephpmyfaq/src/phpMyFAQ/User/UserData.phpsource thorsten/phpmyfaq@0f43d4b8b3+5−0
@@ -76,9 +76,14 @@ } $array = $this->configuration->getDb()->fetchArray($res); + // Decode HTML entities in display_name for backward compatibility+ if (isset($array['display_name'])) {+ $array['display_name'] = htmlspecialchars_decode($array['display_name'], ENT_QUOTES);+ }+ return $singleReturn && $field != '*' ? $array[$field] : $array;Show 4 hidden lines
} /** * Returns the first result of the given key.The data accessor decodes HTML entities in the stored display name.
Security fix
Fixphpmyfaq/assets/templates/admin/user/users.twigsource thorsten/phpmyfaq@61829e8341+1−1
@@ -237,11 +237,11 @@ </tfoot> {% endif %} <tbody> {% for user in users %} <tr class="row_user_id_{{ user.id }}" id="row_user_id_{{ user.id }}">- <td>{{ user.display_name|raw }}</td>+ <td>{{ user.display_name }}</td> <td> <a href="mailto:{{ user.email|raw }}"> {{ user.email|raw }}Show 2 hidden lines
</a> </td>The user-list template removes the raw filter so display names receive normal escaping.
Patch fingerprints
AI-assisted change 67990da958f6f5e991aeca93daa803da9fb03b66430f282aa0aaee4c978379dd · Fix 43cf1eadeef00763d4621140efe7279e5154e51f7d5adfaca90bbd594cf9d284
Advisory references
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc
- https://nvd.nist.gov/vuln/detail/CVE-2025-68951
- https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370
- https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87
- https://github.com/advisories/GHSA-jv8r-hv7q-p6vc