| Title | fatfree fatfree-core <= 3.9.2 Information Disclosure |
|---|
| Description | Fat-Free Framework (fatfree-core) is a PHP micro-framework. Its core HTTP client,
Web::instance()->request(), disables TLS certificate verification unconditionally,
so every HTTPS request made through the framework accepts any certificate (CWE-295).
A man-in-the-middle on the network path can read and modify the full request and
response, including API tokens, Basic-Auth credentials and session data.
Defect
- web.php, function _curl():
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, FALSE);
Certificate verification is hardcoded off; there is no configuration opt-in.
- Version boundary (tag-pinned):
v3.6.0 (tag 311047de45) : web.php:293 = FALSE
3.9.2 (tag 3ba261541e, released 2025-12-02) : web.php:379 = FALSE
-- last affected release
3.9.3 (tag fc299466ea, released 2026-07-21) : TRUE -- fixed
Impact
Any PHP application that uses the framework HTTP client to call HTTPS endpoints over
an untrusted network (public APIs, webhooks, update feeds). Credentials or tokens
passed in headers or URLs are exposed to a MITM, and responses can be forged.
The package has 705,305 total downloads and 12,966 monthly downloads on Packagist.
Vendor confirmation
Issue #412 "CWE-295: TLS certificate verification disabled in core _curl() HTTP
client" (2026-07-15). Maintainer ikkez replied: "I have no idea why this was
hard-coded in here. It makes totally sense to remove it or make this configurable at
least.. I'll have a look at it." Six days later the same maintainer closed the issue
with "fixed in latest commit" (2026-07-21).
Fix
Commit a2c755c8dc9a (2026-07-21, "fix: allow TLS cert verification configuration,
#412") changes CURLOPT_SSL_VERIFYPEER from FALSE to TRUE in web.php and adds a
configuration hook. Released in 3.9.3 (2026-07-21T23:37:18Z).
CVSS 3.1: 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
-- MITM position required (AC:H); no privileges, no user interaction.
CWE: CWE-295 (Improper Certificate Validation)
No prior CVE: an NVD keyword search for "fatfree" returns only Fat Free CRM entries
(CVE-2013-7222, CVE-2018-1000842), which are unrelated to Fat-Free Framework.
Repository: https://github.com/f3-factory/fatfree-core
Public issue: https://github.com/f3-factory/fatfree-core/issues/412
Fix commit: https://github.com/f3-factory/fatfree-core/commit/a2c755c8dc9a |
|---|
| Source | ⚠️ https://github.com/f3-factory/fatfree-core/issues/412 |
|---|
| User | NeoWSY (UID 82976) |
|---|
| Submission | 10/04/2026 13:18 (28 days ago) |
|---|
| Moderation | 10/18/2026 19:47 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422019 [f3-factory fatfree-core up to 3.9.2 HTTP Client web.php _curl certificate validation] |
|---|
| Points | 20 |
|---|