CVE-2026-124622

A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 will fix this issue. The name of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. Upgrading the affected component is recommended. The project maintainer explains: "[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the "Code Execution" impact additionally assumes the symlink target is a web-served .php file."

• CWE-362
• CWE-367

• https://github.com/olivier-ls/php-fts/
• https://github.com/olivier-ls/php-fts/commit/0b2fae333d6b022da7ed4c43e2d41aa03f91dff3
• https://github.com/olivier-ls/php-fts/issues/3
• https://github.com/olivier-ls/php-fts/releases/tag/v1.1.4
• https://vuldb.com/cve/CVE-2026-124622
• https://vuldb.com/submit/1040549
• https://vuldb.com/vuln/433047
• https://vuldb.com/vuln/433047/cti

Published

Nov 9, 2026

Last Modified

Nov 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-124604The RSA cryptographic key material, including a private key …6.2
• CVE-2026-12461Out of bounds read in WebRTC in Google Chrome on Windows pri…6.5
• CVE-2026-124610Rejected reason: 依 VUL-2026-008441 判定為主
• CVE-2026-124617Rejected reason: 歸類為 JSONCPP Open Source 之問題
• CVE-2026-12462Use after free in Media in Google Chrome prior to 149.0.7827…7.5
• CVE-2026-124621A vulnerability was determined in kongxin-github Java_Librar…7.4
• CVE-2026-124623A security flaw has been discovered in PipraPay 3.0.0. Affec…4.7
• CVE-2026-124624A weakness has been identified in PipraPay 3.0.0. Affected b…5.3
• CVE-2026-124625A security vulnerability has been detected in PipraPay 3.0.0…6.3
• CVE-2026-124627In affected versions of Octopus Server, incorrect validation…8.7
• CVE-2026-124628In affected versions of Octopus Server, incorrect validation…8.7
• CVE-2026-12463Inappropriate implementation in Views in Google Chrome on Li…4.7