PT-2026-117325

CVE-2026-112103

Published

2026-10-19

Updated

2026-10-19

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

Name of the Vulnerable Software and Affected Versions f3-factory fatfree-core versions prior to 3.9.3

Description A remote issue exists in the HTTP Client component within the curl() function of the web.php file. This flaw leads to improper certificate validation, which occurs when the system fails to correctly verify the authenticity of a digital certificate. Exploitation of this issue is considered highly complex and difficult.

Recommendations Update to version 3.9.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Siyang Wu

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

CWE-295: Improper Certificate Validation