CVE-2026-93956

Received Received - Intake

XSS in PHP-FTS Search Engine via Query Parameter

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulDB

Description

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 1.1.3 can resolve this issue. This patch is called 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93956

Affected Vendors & Products

Vendor	Product	Version / Range
olivier-ls	php-fts	to 1.1.2 (inc)
olivier-ls	php-fts	1.1.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in olivier-ls PHP-FTS up to version 1.1.2. It exists in the SearchEngine::buildHighlights function of src/SearchEngine.php. An attacker can manipulate the Query argument to inject malicious scripts, which may execute in a victim's browser. The vendor has released version 1.1.3 to fix this issue.

Detection Guidance

This vulnerability is specific to the olivier-ls PHP-FTS library up to version 1.1.2 and involves a cross-site scripting flaw in the SearchEngine::buildHighlights function. Detection should focus on identifying the vulnerable version of the library in your PHP application dependencies.

Impact Analysis

This vulnerability allows remote attackers to execute malicious scripts in the context of a user's browser session. This could lead to theft of session cookies, account takeover, or unauthorized actions on behalf of the user. Users of affected versions should upgrade immediately.

Compliance Impact

This vulnerability is a cross-site scripting (XSS) flaw in PHP-FTS up to 1.1.2 that allows remote attackers to inject malicious scripts via manipulated query arguments. XSS vulnerabilities can lead to unauthorized data access or manipulation, which may violate GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade the olivier-ls PHP-FTS component to version 1.1.3 or later to resolve the cross-site scripting vulnerability in the SearchEngine.php file.

Hi! I’m here to help you understand CVE-2026-93956. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70