Read the docs
TI-2026-63215 Aliases CVE-2026-93956GHSA-746c-pwvm-v4p5

olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 1.1.3 can resolve this issue. This patch is called 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00416 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed PHP-FTS (olivier-ls): 1.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
olivier-lsPHP-FTS1.1.0; 1.1.1; 1.1.21.1.3Patch availableCNA
  • PHP-FTS Vendorolivier-ls Affected 1.1.0; 1.1.1; 1.1.2 Fixed in 1.1.3 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:olivier-ls:php-fts:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:olivier-ls:php-fts:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA PHP-FTS (olivier-ls) Fixed in 1.1.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93956
  2. 2026-10-03 Alias added: GHSA-746c-pwvm-v4p5

References

Exploit 1

Patch 2

Other 2

  • TI-2026-63216 olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences