CVE-2026-93957: PHP-FTS Incorrect Comparison Vulnerability

CVE-2026-93957 Overview

CVE-2026-93957 is a loose comparison vulnerability [CWE-697] in the olivier-ls PHP-FTS full-text search library through version 1.1.3. The flaw resides in the SearchEngine::matchesSingleFilter function within src/SearchEngine.php, part of the Filter Matching component. An attacker can send crafted input over the network to bypass filter checks because PHP's loose comparison operators return unintended matches for dissimilar types. The maintainer released version 1.1.4 to remediate the issue. Public exploit details have been disclosed, though no active exploitation has been reported.

Critical Impact

Remote attackers with low privileges can bypass filter logic in applications using PHP-FTS, potentially exposing records that should be excluded from search results.

Affected Products

• olivier-ls PHP-FTS versions up to and including 1.1.3
• Applications embedding the SearchEngine component from PHP-FTS
• Fixed in olivier-ls PHP-FTS version 1.1.4

Discovery Timeline

• 2026-09-20 - CVE-2026-93957 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93957

Vulnerability Analysis

The vulnerability affects the matchesSingleFilter method in src/SearchEngine.php, which evaluates whether a document field satisfies a supplied filter. The implementation relies on PHP's loose equality behavior, which performs type juggling before comparing values. This allows values of different types to be treated as equal when they should not be, undermining the filter logic.

Remote exploitation is possible because filter input typically originates from user-supplied search queries. The vendor responded promptly and released a patched build tracked as commit 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3 in the v1.1.4 release. The associated Exploit Prediction Scoring System (EPSS) probability remains low, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper comparison logic classified as [CWE-697]. PHP's loose comparison operator (==) coerces operands into a common type before comparing them. When filter values and stored field values differ in type, coercion produces false matches. For example, the string "0" and integer 0 may compare as equal, and numeric strings may match unrelated numeric values after coercion.

Attack Vector

An authenticated remote attacker submits crafted filter parameters through any application endpoint that forwards user input into PHP-FTS filter evaluation. Because the comparison is type-insensitive, the attacker can craft values that satisfy filters intended to restrict record visibility, effectively bypassing the filter constraint.

# Security patch reference (v1.1.4) - configuration hygiene added
# PHP
*.log

# Tooling caches
.phpunit.cache/
.phpunit.result.cache

Source: GitHub Commit 0b2fae3

<?php
// Uses the library's own standalone autoloader.
require __DIR__ . '/../src/autoload.php';

Source: GitHub Commit 0b2fae3 — the security release replaces ad-hoc autoloading in benchmark/autoload.php with the library's standalone autoloader, aligning benchmark and production code paths.

Detection Methods for CVE-2026-93957

Indicators of Compromise

• Search or filter requests containing type-ambiguous values such as "0", "true", or numeric strings that shouldn't match expected filter fields
• Application log entries showing search results returning records that should be excluded by an applied filter
• Unexpected access patterns targeting endpoints wired to PHP-FTS filter parameters

Detection Strategies

• Inventory PHP dependencies and flag any project using olivier-ls/php-fts at version 1.1.3 or earlier
• Review calls to SearchEngine::matchesSingleFilter in application code and add server-side type validation before invocation
• Add static analysis rules to detect PHP loose comparison operators (==, !=) applied to user-supplied filter values

Monitoring Recommendations

• Log filter parameters and result counts for search endpoints to identify anomalous match volumes
• Alert on repeated queries where filter inputs are boolean strings, empty strings, or 0-equivalent values
• Correlate authentication logs with search activity to detect low-privilege accounts probing filter bypass conditions

How to Mitigate CVE-2026-93957

Immediate Actions Required

• Upgrade olivier-ls/php-fts to version 1.1.4 using Composer: composer require olivier-ls/php-fts:^1.1.4
• Audit application code that passes untrusted input into PHP-FTS filter evaluation and enforce strict type validation
• Restrict access to search endpoints that expose filter parameters, requiring authentication where feasible

Patch Information

The maintainer released the fix in commit 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3, published as GitHub Release v1.1.4. See GitHub Issue #2 for the disclosure discussion and VulDB CVE-2026-93957 for cross-reference metadata.

Workarounds

• Coerce filter inputs to explicit types before passing them to PHP-FTS, matching the type of stored field values
• Wrap filter evaluation with a strict comparison shim using PHP's === operator until upgrading is possible
• Disable or gate search functionality that accepts arbitrary filter fields from untrusted users

# Upgrade PHP-FTS to the patched version
composer require olivier-ls/php-fts:^1.1.4
composer update olivier-ls/php-fts
composer show olivier-ls/php-fts | grep versions