Live › vulnerability › CVE-2026-112103
Go to dashboardThe _curl function in the HTTP Client of fatfree-core up to 3.9.2 does not validate certificates properly when it makes outbound HTTPS requests. A remote attacker positioned on the network path could intercept or alter traffic the application sends to remote servers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use fatfree-core's HTTP Client to make outbound HTTPS requests are exposed, since the flaw sits in how that client validates server certificates. Sites that never call the HTTP Client for remote requests have no outbound path to abuse. The sources note that exploitation is highly complex and difficult.
No product ranges from the sources yet.
composer show f3-factory/fatfree-core and look for anything at or below 3.9.2._curl path in web.php where certificate verification is disabled.3.9.3 or later, which the sources say resolves the issue (upstream patch a2c755c8dc9ad0eb7d5fd261b09aff90f649433c).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 3.9.3 is able to resolve this issue. The name of the patch is a2c755c8dc9ad0eb7d5fd261b09aff90f649433c. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
This page as .md · .json · in your agent: get_signal("CVE-2026-112103")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.