Local Time-of-Check Time-of-Use Vulnerability in Olivier-ls PHP-FTS
CVE-2026-124622

4.8MEDIUM

Key Information:

Vendor

Olivier-ls

Status
PHP-fts
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124622?

A vulnerability has been detected in Olivier-ls PHP-FTS versions up to 1.1.3, specifically in the TrigramIndex::open function found in Storage.php. This issue arises due to potential time-of-check time-of-use scenarios, requiring local write access to the index directory by a user other than the application owner. While this situation may not be directly reachable from a remote perspective, it poses significant risks, especially in shared hosting environments. Implementing the recommended upgrade to version 1.1.4 mitigates this risk effectively.

Affected Version(s)

PHP-FTS 1.1.0

PHP-FTS 1.1.1

PHP-FTS 1.1.2

References

https://vuldb.com/vuln/433047
vdb-entrytechnical-description
https://vuldb.com/vuln/433047/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124622
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

summmm (VulDB User)
VulDB CNA Team
.