Security test: From-header stored XSS on news-web.php.net (php.net VDP)
| From: | <svg/onload=alert(document.domain)> | Date: | Sat, 18 Jul 2026 14:09:13 +0000 |
| Subject: | Security test: From-header stored XSS on news-web.php.net (php.net VDP) | ||
| Groups: | php.test | ||
| Request: | Send a blank email to php-test+get-1685@lists.php.net to get a copy of this message | ||
Authorized security research PoC under the php.net vulnerability disclosure program
(https://www.php.net/.well-known/security.txt).
Issue: the From-header display name of archived messages is rendered WITHOUT
HTML escaping on news-web.php.net group listing and article pages
(format_author() in web-news lib/common.php - missing htmlspecialchars on $name).
This message is benign (alert only). Full report to security@php.net.
Researcher: bugtest888@gmail.com