| शीर्षक | olivier-ls PHP-FTS V1.1.3 Link Following / TOCTOU |
|---|
| विवरण | PHP-FTS (ols/php-fts) before an unreleased fix follows symbolic links when opening its binary index files. `TrigramIndex::open()` uses a `file_exists()` then `fopen()` two-step TOCTOU pattern with no symlink protection, and `DocumentStorage`, `PostingsStorage`, and `TombstoneStorage` fall back from `fopen('r+b')` to `fopen('w+b')`, which follows a dangling symlink and creates/truncates the target.
A local attacker with write access to the index directory can place a symlink at a predictable filename to cause the application to create or overwrite an arbitrary file (including a web-accessible .php file) with attacker-influenced content, potentially leading to arbitrary file write and code execution.
Reproduction: https://github.com/sumo166/CVE-apply/blob/main/olivier-ls/php-fts/Storage%20open%20Symlink%20TOCTOU%20Arbitrary%20File%20Write%20(CWE-59)_cve.md |
|---|
| स्रोत | ⚠️ https://github.com/olivier-ls/php-fts/issues/3 |
|---|
| उपयोगकर्ता | summmm (UID 69690) |
|---|
| सबमिशन | 17/10/2026 03:19 PM (23 दिन पहले) |
|---|
| संयम | 09/11/2026 07:57 AM (23 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 433047 [olivier-ls PHP-FTS तक 1.1.3 Storage.php TrigramIndex::open रेस कंडीशन] |
|---|
| अंक | 20 |
|---|