CVE-2026-112103

LOW 3.7

f3-factory fatfree-core HTTP Client web.php _curl certificate validation

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 3.9.3 is able to resolve this issue. The name of the patch is a2c755c8dc9ad0eb7d5fd261b09aff90f649433c. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CWE	CWE-295 CWE-287
Vendor	f3-factory
Product	fatfree-core
Published	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for f3-factory fatfree-core

Be the first to know when new low vulnerabilities affecting f3-factory fatfree-core are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

f3-factory / fatfree-core

3.9.0 3.9.1 3.9.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/422019 vuldb.com: https://vuldb.com/vuln/422019/cti vuldb.com: https://vuldb.com/cve/CVE-2026-112103 vuldb.com: https://vuldb.com/submit/1013092 github.com: https://github.com/f3-factory/fatfree-core/issues/412 github.com: https://github.com/f3-factory/fatfree-core/commit/a2c755c8dc9ad0eb7d5fd261b09aff90f649433c github.com: https://github.com/f3-factory/fatfree-core/releases/tag/3.9.3 github.com: https://github.com/f3-factory/fatfree-core/

Credits

🔍 NeoWSY (VulDB User) VulDB CNA Team