CVE-2026-124622 | olivier-ls PHP-FTS up to 1.1.3 Storage.php TrigramIndex::open toctou

A vulnerability described as problematic has been identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use.

This vulnerability is documented as CVE-2026-124622. The attack needs to be performed locally. There is not any exploit available.

Upgrading the affected component is recommended.

The project maintainer explains: “[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the “Code Execution” impact additionally assumes the symlink target is a web-served .php file.”VulDB Recent EntriesRead More