CVE-2026-42549 Details
Description
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1.
A path traversal vulnerability has been identified in Flight PHP versions prior to 3.18.1. The issue arises in the make:controller command, where the CLI command creates directories recursively based on the user-supplied controller name before validating the class name. This premature directory creation can lead to arbitrary directories being created outside the project root, taking advantage of directory traversal sequences. The vulnerability is exacerbated on Windows systems, where the backslash directory separator introduces additional traversal possibilities.
Users can upgrade to Flight PHP version 3.18.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 13, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flight | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | New CVE Received | [email protected] |