{"id":"CVE-2026-112103","kind":"vulnerability","aliases":["CVE-2026-112103"],"related":[],"title":"Fat-Free Framework: HTTP client skips TLS certificate checks in curl","description":"A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 3.9.3 is able to resolve this issue. The name of the patch is a2c755c8dc9ad0eb7d5fd261b09aff90f649433c. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","summary":"The _curl function in the HTTP Client of fatfree-core up to 3.9.2 does not validate certificates properly when it makes outbound HTTPS requests. A remote attacker positioned on the network path could intercept or alter traffic the application sends to remote servers.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fat-free-framework","fatfree-core","package","php","self-hosted"],"not_affected_if":["no-outbound-http-client-use"],"how_to_check":"- Check the installed version of fatfree-core with `composer show f3-factory/fatfree-core` and look for anything at or below `3.9.2`.\n- Search the application code for calls to the HTTP Client's `_curl` path in `web.php` where certificate verification is disabled.","fix":"- Upgrade f3-factory/fatfree-core to `3.9.3` or later, which the sources say resolves the issue (upstream patch a2c755c8dc9ad0eb7d5fd261b09aff90f649433c).","status":"open","published_at":"2026-10-19T11:17:16+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:01:47+00:00","updated_at":"2026-10-25T04:01:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:01:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade f3-factory/fatfree-core to `3.9.3` or later, which the sources say resolves the issue (upstream patch a2c755c8dc9ad0eb7d5fd261b09aff90f649433c).","reach":"network","title":"Fat-Free Framework: HTTP client skips TLS certificate checks in curl","impact":"medium","summary":"The _curl function in the HTTP Client of fatfree-core up to 3.9.2 does not validate certificates properly when it makes outbound HTTPS requests. A remote attacker positioned on the network path could intercept or alter traffic the application sends to remote servers.","category":"package","nicknames":[],"who_cares":["php","fat-free-framework","fatfree-core","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker intercepts outbound HTTPS traffic from the app and reads or changes it","analyst_note":"","how_to_check":"- Check the installed version of fatfree-core with `composer show f3-factory/fatfree-core` and look for anything at or below `3.9.2`.\n- Search the application code for calls to the HTTP Client's `_curl` path in `web.php` where certificate verification is disabled.","needs_analyst":false,"not_affected_if":["no-outbound-http-client-use"],"who_is_affected":"Applications that use fatfree-core's HTTP Client to make outbound HTTPS requests are exposed, since the flaw sits in how that client validates server certificates. Sites that never call the HTTP Client for remote requests have no outbound path to abuse. The sources note that exploitation is highly complex and difficult.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000646,"input_tokens":3432,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112103':15A,18A '-2026':14A,17A '3.9.2':44B,89C '3.9.3':137C 'a2c755c8dc9ad0eb7d5fd261b09aff90f649433c':150C 'abl':139C 'affect':92C,155C,176C 'alter':67B 'applic':70B 'attack':58B,113C,119C 'certif':9A,48B,110C 'check':10A 'client':6A,37B,104C 'complex':125C 'compon':102C,156C 'contact':160C 'core':25B,41B,86C 'could':64B 'curl':12A,32B,95C 'cve':13A,16A 'difficult':133C 'earli':161C 'exploit':131C 'f3':82C 'f3-factory':81C 'factori':83C 'fat':2A,20B 'fat-fre':1A 'fat-free-framework':19B 'fatfre':24B,40B,85C 'fatfree-cor':23B,39B,84C 'file':98C 'fix':172C 'found':79C 'framework':4A,22B 'free':3A,21B 'function':33B,94C 'high':124C 'host':30B 'http':5A,36B,103C 'https':54B 'improp':109C 'intercept':65B 'issu':143C 'lead':107C 'make':52B 'manipul':106C 'manner':167C 'may':114C 'name':145C 'natur':122C 'network':62B 'outbound':53B 'packag':26B 'patch':148C 'path':63B 'perform':116C 'php':27B 'posit':59B 'product':177C 'profession':166C 'proper':49B 'quick':169C 'releas':170C 'remot':57B,73B,118C 'request':55B 'resolv':141C 'respond':162C 'self':29B 'self-host':28B 'send':71B 'server':74B 'skip':7A 'state':128C 'tls':8A 'traffic':68B 'upgrad':134C,153C 'valid':47B,111C 'vendor':158C 'version':136C,173C 'vulner':76C,91C 'web.php':99C","nicknames":[],"mitigations":[],"who_affected":"Applications that use fatfree-core's HTTP Client to make outbound HTTPS requests are exposed, since the flaw sits in how that client validates server certificates. Sites that never call the HTTP Client for remote requests have no outbound path to abuse. The sources note that exploitation is highly complex and difficult.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T11:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112103","severity":null,"published_at":"2026-10-19T11:17:16+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}