Improper Certificate Validation in f3-factory's HTTP Client

CVE-2026-112103

What is CVE-2026-112103?

A vulnerability exists in the f3-factory fatfree-core component, specifically in the HTTP Client's _curl function located in web.php. This flaw results in improper validation of SSL certificates, potentially enabling remote attackers to undermine the security of communications. Although exploiting this vulnerability is technically complex, it remains critical for users of affected versions to upgrade to version 3.9.3 or later, where this issue has been effectively addressed. Early contact with the vendor led to a prompt and professional release of a patch (a2c755c8dc9ad0eb7d5fd261b09aff90f649433c) for this vulnerability.

References