Executive brief
PHP-FTS is a self-contained full-text search library used to index and search documents. An incorrect comparison in the SearchEngine's filter matching logic allows attackers to bypass filters using type juggling, potentially returning search results that should have been excluded. An attacker can craft filter values (such as true) that match any non-empty string in a field, circumventing intended data access restrictions.
Technical details
The vulnerability exists in SearchEngine::matchesSingleFilter which performed non-strict comparisons (== and in_array with strict: false), allowing type juggling attacks. A filter value of true would match any document with a non-empty string in that field. The fix implements type-strict comparisons except for int/float which compare numerically. The vulnerability is remote-exploitable via crafted filter parameters in search requests.
Affected products
- olivier-ls PHP-FTS up to 1.1.3
Timeline
- 2026-09-20: disclosed
- 2026-09-06: patched: version 1.1.4