Description

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 1.1.3 can resolve this issue. This patch is called 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-19T23:17:09.707Z",
  "pubdate": "2026-09-19T23:17:09.707Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the olivier-ls PHP-FTS library, specifically within the search engine functionality.\nThe vulnerability allows an unauthenticated, remote attacker to inject malicious scripts into the application by manipulating the 'Query' argument processed by the 'SearchEngine::buildHighlights' function.\nThe primary impact of this flaw is the potential for arbitrary code execution within the victim's browser session, which can lead to session hijacking, unauthorized actions on behalf of the user, or the exfiltration of sensitive information.\nThe affected component is the Search Engine implementation within versions 1.1.2 and earlier. The risk is considered high due to the potential for remote exploitation and the availability of public exploit code.\nSuccessful exploitation requires the application to reflect the unvalidated query input back to the end user. Mitigation is achieved by upgrading to version 1.1.3, which incorporates the necessary input sanitization.",
  "technicalDetails": "The vulnerability resides in the 'SearchEngine::buildHighlights' method located in 'src/SearchEngine.php' within the olivier-ls PHP-FTS component. The root cause is an improper neutralization of input during the generation of search result highlights.\nThe 'buildHighlights' function is designed to take a user-supplied search query and format it for presentation in the user interface. Due to insufficient input validation and a lack of context-aware output encoding on the 'Query' argument, the application fails to distinguish between legitimate search terms and executable script tags.\nAn attacker can exploit this by crafting a malicious 'Query' parameter containing arbitrary HTML and JavaScript, such as '<script>alert(document.cookie)</script>'. When this input is passed to the search engine, the 'buildHighlights' function incorporates the raw, unencoded payload into the resulting search result page returned to the user.\nThe attack flow begins when a remote, unauthenticated attacker submits the crafted request to the endpoint responsible for processing search queries. The server-side code processes the query through the vulnerable 'buildHighlights' logic. Because the output is rendered in the browser without sanitization, the injected payload is treated as a valid element of the DOM.\nOnce the payload is rendered, the browser executes the injected JavaScript within the security context of the origin site. This allows the attacker to access document objects, bypass Same-Origin Policy (SOP) restrictions within that specific scope, capture session tokens, or redirect users to malicious domains.\nThe vulnerability persists across versions up to and including 1.1.2. The security flaw is remediated in version 1.1.3, specifically through patch 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3, which addresses the improper handling of user-supplied data during string construction in the highlight generation process."
}