CVE-2026-124622 Details
Description
A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 will fix this issue. The name of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. Upgrading the affected component is recommended. The project maintainer explains: "[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the "Code Execution" impact additionally assumes the symlink target is a web-served .php file."
A time-of-check time-of-use vulnerability has been identified in Olivier-ls PHP-FTS versions through 1.1.3. The issue arises in the TrigramIndex::open function within Storage.php, where symbolic links are followed when opening index files, creating a potential for exploitation in shared hosting environments. An attacker with write access to the index directory could pre-place a symlink to a web-served PHP file, leading to code execution. This vulnerability requires local exploitation.
Users are advised to upgrade to Olivier-ls PHP-FTS version 1.1.4, which addresses this vulnerability by preventing the library from following symbolic links when opening index files.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/olivier-ls/php-fts/ | [email protected] | Vendor |
| https://github.com/olivier-ls/php-fts/commit/0b2fae333d6b022da7ed4c43e2d41aa03f91dff3 | [email protected] | Source CodeVendor |
| https://github.com/olivier-ls/php-fts/issues/3 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/olivier-ls/php-fts/releases/tag/v1.1.4 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-124622 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1040549 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/433047 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/433047/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| olivier-ls PHP-FTS | <= 1.1.3 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 9, 2026 | New CVE Received | [email protected] |