CVE-2026-93957
Received Received - Intake

Incorrect Comparison in PHP-FTS SearchEngine Filter Matching

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulDB

Description
A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-93957
EUVD
EUVD-2026-83636

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
olivier-ls php-fts to 1.1.3 (inc)
olivier-ls php-fts 1.1.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-93957 is a vulnerability in the php-fts library up to version 1.1.3. It involves a loose comparison issue in the SearchEngine::matchesSingleFilter function where PHP's weak type comparison operators allow type juggling. This lets non-empty strings be treated as true, bypassing filters meant for access control or tenant isolation. Attackers can exploit this to match documents across unintended categories or tenants.

Detection Guidance

Check the installed version of php-fts by running: composer show olivier-ls/php-fts. If the version is below 1.1.4, the system is vulnerable. Review search queries using weak comparison operators (==, !=, in_array with strict:false) in src/SearchEngine.php for potential filter bypass attempts.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive data by bypassing intended access controls. For example, an attacker might retrieve documents from all categories or tenants instead of just the intended ones. This could lead to data leaks, privilege escalation, or unauthorized information disclosure depending on the application's use of filters.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to personal or health data. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. Exploiting this flaw may result in unauthorized data exposure, violating these regulations and potentially leading to legal penalties or data breach notifications.

Mitigation Strategies

Upgrade php-fts to version 1.1.4 immediately using: composer require olivier-ls/php-fts:^1.1.4. Review and update any search filters to use strict comparisons (===, !==) to prevent type juggling. Monitor for unusual search queries that bypass access controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93957. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart