Description
A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 3.9.3 is able to resolve this issue. The name of the patch is a2c755c8dc9ad0eb7d5fd261b09aff90f649433c. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Published: 2026-10-19
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Certificate validation bypass
Action: Patch
AI Analysis

Impact

An improper certificate validation flaw exists in the _curl function of the HTTP Client component of fatfree-core. The flaw allows an attacker to use a forged or otherwise untrusted certificate during a remote connection, effectively bypassing server certificate checks. This can enable man‑in‑the‑middle attacks or credential theft. The CVSS score of 6.3 indicates moderate severity, and the description states that exploitation is difficult and highly complex.

Affected Systems

The vulnerability affects the fatfree-core PHP framework from f3-factory, specifically all releases up to and including version 3.9.2. Versions 3.9.3 and later contain the fixed commit identified by a2c755c8dc9ad0eb7d5fd261b09aff90f649433c.

Risk and Exploitability

The CVSS score of 6.3 reflects the potential impact of a remote attacker bypassing certificate validation. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, and the description notes that exploitation requires a high level of skill and complexity, suggesting that while the risk is moderate, the likelihood of successful exploitation in the wild is relatively low.

Generated by OpenCVE AI on October 19, 2026 at 11:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade fatfree-core to version 3.9.3 or later, which incorporates the security patch from commit a2c755c8dc9ad0eb7d5fd261b09aff90f649433c.
  • Reconfigure the HTTP client to enforce strict server certificate verification, rejecting any certificates that do not match the trusted root CA list.
  • If an immediate upgrade is infeasible, remove or disable usage of the vulnerable _curl function in your application until the patch can be applied.

Generated by OpenCVE AI on October 19, 2026 at 11:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 3.9.3 is able to resolve this issue. The name of the patch is a2c755c8dc9ad0eb7d5fd261b09aff90f649433c. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title f3-factory fatfree-core HTTP Client web.php _curl certificate validation
First Time appeared F3-factory
F3-factory fatfree-core
Weaknesses CWE-287
CWE-295
CPEs cpe:2.3:a:f3-factory:fatfree-core:*:*:*:*:*:*:*:*
Vendors & Products F3-factory
F3-factory fatfree-core
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

F3-factory Fatfree-core
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T12:46:14.439Z

Reserved: 2026-10-18T17:46:56.753Z

Link: CVE-2026-112103

cve-icon Vulnrichment

Updated: 2026-10-19T12:46:07.805Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T11:17:16.773

Modified: 2026-10-19T15:16:45.150

Link: CVE-2026-112103

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:15:06Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-295

    Improper Certificate Validation