CVE-2026-112103
Received Received - Intake

Improper Certificate Validation in f3-factory fatfree-core

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 3.9.3 is able to resolve this issue. The name of the patch is a2c755c8dc9ad0eb7d5fd261b09aff90f649433c. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112103
EUVD
EUVD-2026-104225

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
f3-factory fatfree-core 3.9.0
f3-factory fatfree-core 3.9.1
f3-factory fatfree-core 3.9.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112103 is a vulnerability in the Fat-Free Framework's HTTP client component. The issue occurs in the _curl function of web.php where TLS certificate validation is improperly handled. Specifically, the CURLOPT_SSL_VERIFYPEER option is hardcoded to FALSE, disabling certificate verification while hostname verification remains enabled. This allows attackers to intercept sensitive data or manipulate API responses by presenting a self-signed certificate for the correct hostname.

Detection Guidance

To detect this vulnerability, check if your system uses fatfree-core versions up to 3.9.2. Inspect the web.php file for the _curl function and verify if CURLOPT_SSL_VERIFYPEER is set to FALSE. Use commands like grep -r "CURLOPT_SSL_VERIFYPEER" /path/to/fatfree-core/ to search for the setting.

Impact Analysis

This vulnerability may allow remote attackers to intercept sensitive data such as Basic Authentication credentials, session cookies, custom headers, or manipulate API responses. The attack complexity is high but possible from a network-adjacent position. Systems using affected versions of fatfree-core up to 3.9.2 are vulnerable unless upgraded to version 3.9.3 or later.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, violating confidentiality requirements in GDPR and HIPAA. Improper TLS validation may result in non-compliance with data protection standards requiring secure transmission of personal or health information. Organizations must upgrade to patched versions to maintain compliance.

Mitigation Strategies

Upgrade fatfree-core to version 3.9.3 or later. This version enables TLS certificate verification by default. Alternatively, manually set CURLOPT_SSL_VERIFYPEER to TRUE in the _curl function if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112103. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart