Description
A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Published: 2026-09-20
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized Access
Action: Patch
AI Analysis

Impact

The vulnerability arises in SearchEngine::matchesSingleFilter of PHP‑FTS. Manipulating filter parameters causes an incorrect comparison which an attacker can exploit remotely to bypass the intended filtering logic. This flaw, identified by CWE‑697, can allow an attacker to access data that should have been filtered out.

Affected Systems

The affected product is the PHP‑FTS library from olivier‑ls. Versions up to and including 1.1.3 are vulnerable. The vendor released a fix in version 1.1.4, identified by commit 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk level. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. The attack vector is remote; exploitation is achievable by sending crafted filter input to the SearchEngine endpoint. The patch mitigates the issue by correcting the comparison logic.

Generated by OpenCVE AI on September 20, 2026 at 02:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade PHP‑FTS to version 1.1.4 or later, which contains the corrected comparison logic.
  • Restrict or sanitize user supplied filter parameters so that only valid comparison values are accepted, reducing the attack surface until a patch can be applied.
  • Monitor application logs for attempts to use crafted filter parameters that could indicate exploitation.

Generated by OpenCVE AI on September 20, 2026 at 02:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison
First Time appeared Olivier-ls
Olivier-ls php-fts
Weaknesses CWE-697
CPEs cpe:2.3:a:olivier-ls:php-fts:*:*:*:*:*:*:*:*
Vendors & Products Olivier-ls
Olivier-ls php-fts
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Olivier-ls Php-fts
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-20T01:00:10.532Z

Reserved: 2026-09-19T09:01:17.190Z

Link: CVE-2026-93957

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-20T02:16:52.973

Modified: 2026-09-20T02:16:52.973

Link: CVE-2026-93957

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T03:00:11Z

Weaknesses