A race condition exists in the TrigramIndex::open function of olivier‑ls PHP‑FTS; it is triggered by a time‑of‑check time‑of‑use flaw that allows a user who can write to the index directory to create a symbolic link that points to a file outside the intended location. When the application subsequently opens the index file, it may follow the symlink and read a web‑served PHP file, leading to the execution of arbitrary code in the context of the web application. The flaw therefore permits local code execution when directory permissions are incorrectly set, and if the symlink targets a PHP file that the web server exposes, the impact could grow to remote code execution.

The vulnerability affects olivier‑ls PHP‑FTS versions up to and including 1.1.3. Version 1.1.4 and later contain the fix; upgrading to that release eliminates the flaw. Any system running the affected package, particularly in a shared‑hosting environment where the application user is distinct from other users who may write to the index directory, is at risk.

With a CVSS score of 4.8 the flaw is considered moderate; exploitation requires local write access to the index directory and the creation of a symlink to a web‑exposed PHP file. The EPSS score is not available and the issue is not listed in CISA KEV. The impact is limited to environments where directory permissions are permissive, but successful exploitation would allow the attacker to execute arbitrary PHP code. The overall risk is moderate and depends on the specific hosting configuration.