Read the docs
TI-2026-63216 Aliases CVE-2026-93957GHSA-hvmw-v77x-f8j7

olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison

Priority LOW 25CWE-697Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00491 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed PHP-FTS (olivier-ls): 1.1.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
olivier-lsPHP-FTS1.1.0; 1.1.1; 1.1.2; 1.1.31.1.4Patch availableCNA
  • PHP-FTS Vendorolivier-ls Affected 1.1.0; 1.1.1; 1.1.2; 1.1.3 Fixed in 1.1.4 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:olivier-ls:php-fts:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:olivier-ls:php-fts:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA PHP-FTS (olivier-ls) Fixed in 1.1.4

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93957
  2. 2026-10-03 Alias added: GHSA-hvmw-v77x-f8j7
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Exploit 1

Patch 2

Other 2

  • TI-2026-63215 olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences