olivier-ls PHP-FTS up to 1.1.3 Storage.php TrigramIndex::open toctou

Summaryinfo

A vulnerability classified as problematic has been found in olivier-ls PHP-FTS up to 1.1.3. Affected is the function TrigramIndex::open of the file Storage.php. Performing a manipulation results in toctou. This vulnerability is reported as CVE-2026-124622. The attack requires a local approach. No exploit exists. It is recommended to upgrade the affected component. The project maintainer explains: "[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the "Code Execution" impact additionally assumes the symlink target is a web-served .php file."

Detailsinfo

A vulnerability, which was classified as problematic, was found in olivier-ls PHP-FTS up to 1.1.3. This affects the function TrigramIndex::open of the file Storage.php. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This is going to have an impact on confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-124622. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

The project maintainer explains: "[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the "Code Execution" impact additionally assumes the symlink target is a web-served .php file." By approaching the search of inurl:Storage.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.1.4 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• olivier-ls

Name

• PHP-FTS

Version

• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3

License

• open-source

Website

• Product: https://github.com/olivier-ls/php-fts/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1040549: olivier-ls PHP-FTS V1.1.3 Link Following / TOCTOU (by summmm)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion