CVE-2026-93956: PHP-FTS Search Engine XSS Vulnerability

CVE-2026-93956 Overview

CVE-2026-93956 is a stored cross-site scripting (XSS) vulnerability in the olivier-ls PHP-FTS full-text search library up to version 1.1.2. The flaw resides in the SearchEngine::buildHighlights function within src/SearchEngine.php. Attackers can manipulate the Query argument to inject script content that is rendered in the highlight output. The issue is tracked under [CWE-79] and can be exploited remotely with low privileges and user interaction. The maintainer released a fix in version 1.1.3, identified by commit 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. A public exploit reference has been published.

Critical Impact
Attackers can inject arbitrary script content through the search Query parameter, enabling session-context script execution in the browsers of users viewing highlighted search results.

Affected Products

olivier-ls PHP-FTS versions up to and including 1.1.2
Component: Search Engine (src/SearchEngine.php)
Function: SearchEngine::buildHighlights

Discovery Timeline

2026-09-19 - CVE-2026-93956 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-93956

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the buildHighlights method of the SearchEngine class. The function processes the user-supplied Query argument to construct highlighted snippets around matched terms in indexed content. Because the query value is embedded into the output without sufficient contextual encoding, script content supplied by an attacker is rendered verbatim in the resulting HTML.

Exploitation requires network access to the affected application and some form of user interaction, such as viewing a page that renders the highlighted results. The impact is limited to the integrity of the rendered page: attackers can execute script in the victim's browser session, but the flaw does not directly expose confidential data or disrupt availability at the server layer.

The CWE-79 report published alongside the CVE classifies the issue as a stored XSS because the malicious query terms can persist in application state that later renders highlights for other users.

Root Cause

The root cause is missing output encoding when reflecting query terms into HTML markup produced by buildHighlights. The library concatenates the query fragment into the highlight wrapper element without applying HTML entity encoding, so any <script> or event-handler payload survives into the rendered DOM.

Attack Vector

An unauthenticated or low-privilege attacker submits a crafted search query containing HTML or JavaScript payloads. When the application invokes SearchEngine::buildHighlights and renders the result, the browser interprets the injected markup. The attack requires user interaction to trigger execution, typically loading a page that displays the highlighted output.

text

// Security patch reference — commit 0b2fae3 (v1.1.3)
// The upstream fix reorganizes autoloading and ships as part of
// the 1.1.3 security release. Users must upgrade to obtain the
// sanitization change applied to SearchEngine::buildHighlights.

// benchmark/autoload.php (before -> after)
- spl_autoload_register(function (string $class): void {
-     $class = str_replace('Ols\\PhpFts\\', '', $class);
-     require __DIR__ . '/../src/' . $class . '.php';
- });
+ // Uses the library's own standalone autoloader.
+ require __DIR__ . '/../src/autoload.php';

Source: GitHub Commit 0b2fae3

Detection Methods for CVE-2026-93956

Indicators of Compromise

Search query parameters containing HTML tags, <script> blocks, or event handlers such as onerror= and onload=.
Stored search terms or logged queries that include encoded angle brackets (%3Cscript%3E) or JavaScript URIs.
Application logs showing repeated queries against endpoints backed by PHP-FTS versions at or below 1.1.2.

Detection Strategies

Inspect deployed PHP dependencies for olivier-ls/php-fts at version 1.1.2 or earlier and flag any instance.
Add web application firewall rules that identify script tags, JavaScript URIs, and common XSS payload patterns in query parameters passed to search endpoints.
Review rendered highlight output in HTTP responses for unencoded angle brackets originating from user-supplied query terms.

Monitoring Recommendations

Log all search queries submitted to endpoints backed by PHP-FTS and alert on payloads containing HTML control characters.
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on pages that render search highlights.
Track outbound requests initiated from pages hosting search results to identify potential exfiltration triggered by injected scripts.

How to Mitigate CVE-2026-93956

Immediate Actions Required

Upgrade olivier-ls/php-fts to version 1.1.3 or later, which contains commit 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3.
Audit application code that calls SearchEngine::buildHighlights and confirm the returned markup is treated as untrusted until the upgrade is in place.
Enforce a restrictive Content Security Policy that blocks inline scripts on pages rendering search highlights.

Patch Information

The maintainer released version 1.1.3 of PHP-FTS containing the security fix referenced by commit hash 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. Refer to the GitHub PHP FTS Repository and the GitHub Tags for PHP FTS for release artifacts, and review the CWE-79 Stored XSS Report for the vulnerability writeup.

Workarounds

Apply HTML entity encoding to search query parameters before invoking buildHighlights, using PHP's htmlspecialchars() with ENT_QUOTES | ENT_HTML5.
Deploy a WAF rule that strips or blocks HTML tags and JavaScript URIs from search query parameters until the library upgrade completes.
Restrict search functionality to authenticated users and log query submissions to support post-incident review.

bash

# Composer upgrade to the fixed release
composer require olivier-ls/php-fts:^1.1.3
composer update olivier-ls/php-fts

# Verify installed version
composer show olivier-ls/php-fts | grep versions