CVE-2026-42551 Details
Description
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.
A vulnerability in Flight PHP versions prior to 3.18.1 allows for Cross-Site Request Forgery (CSRF) escalation by improperly handling the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter. The Request::getMethod() function unconditionally accepts these overrides on any HTTP verb, including safe methods like GET, without any opt-in or whitelist of allowed methods. This flaw enables a GET request to be silently transformed into a DELETE or PUT request, potentially disrupting middleware that relies on HTTP verb safety and causing cache poisoning between Content Delivery Networks (CDN) and the origin server.
Users can upgrade to Flight PHP version 3.18.1 or later, where this vulnerability is fixed. In version 3.18.1, a new setting called 'flight.allow_method_override' has been introduced, allowing operators to disable method overrides via the X-HTTP-Method-Override header and the '_method' parameter.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 13, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flightphp/core/security/advisories/GHSA-vxrr-w42w-w76g | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/flightphp/core/security/advisories/GHSA-vxrr-w42w-w76g | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flight | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | New CVE Received | [email protected] |