Security test: From-header stored XSS on news-web.php.net (php.net VDP)

[email protected] ("<svg/onload=alert(document.domain)>") Sat, 18 Jul 2026 14:09:13 -0000

Newsgroups	php.test
Message-ID	<[email protected]>

Authorized security research PoC under the php.net vulnerability disclosure p=
rogram
(https://www.php.net/.well-known/security.txt).

Issue: the From-header display name of archived messages is rendered WITHOUT
HTML escaping on news-web.php.net group listing and article pages
(format_author() in web-news lib/common.php - missing htmlspecialchars on $na=
me).

This message is benign (alert only). Full report to [email protected].
Researcher: [email protected]