fatfree-core EUVD-2026-104225

Exploitation requires (1) the application to actually use Fat-Free's Web HTTP client (the _curl path in web.php) to make outbound HTTPS requests, and (2) the attacker to hold an active man-in-the-middle position on the network path to those endpoints so a forged certificate can be injected - the flaw is that CURLOPT_SSL_VERIFYPEER was hard-disabled, so TLS peer validation never occurs on any such request in versions ≤3.9.2. Limiting factors that reduce real-world risk: the high attack complexity of obtaining a MITM foothold (reflected in AC:H and the vendor's 'difficult' exploitability statement), and the fact that impact is confined to data the application transmits through this specific client. Unauthenticated per PR:N, but not remotely triggerable without the MITM precondition.

This is a medium-severity, low-urgency issue rather than an emergency. The source CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N, base 6.3) encodes the realistic constraint: although reachable over the network with no privileges or user interaction, AC:H reflects that exploitation requires an attacker to already hold a man-in-the-middle position on the TLS path - the description itself states exploitation is 'highly complex' and 'difficult.' No EPSS score, no CISA KEV listing, and no public exploit code were provided, so all three live-exploitation signals are absent; combined with high attack complexity this points to no meaningful mass-exploitation risk. One internal inconsistency should be flagged: the vendor marked confidentiality impact VC:N, yet the root cause (CWE-295 improper certificate validation / disabled CURLOPT_SSL_VERIFYPEER) and the 'Information Disclosure' tag both imply interception of in-transit data, which is a confidentiality concern - the vendor's VC:N appears to understate confidentiality impact; verify against the data your deployment sends through the Web client. No CVSS 3.1 vector was supplied in the input (only 4.0), so 3.1-based tooling comparisons rely on my independent assessment below.

An attacker positioned on the network path between a Fat-Free-based PHP application and the remote HTTPS endpoints it calls (e.g., on a shared/compromised network segment or via DNS/ARP redirection) presents a fraudulent TLS certificate. Because the _curl client sets CURLOPT_SSL_VERIFYPEER to FALSE, the application accepts the forged certificate and the attacker transparently reads and tampers with the HTTPS traffic - including any API keys, tokens, or sensitive payloads in flight. No public exploit code was identified, and the attack requires an active MITM foothold, matching the CVSS AC:H rating.