CVE-2026-42549: Flight PHP path traversal in make:controller CLI command

CVE-2026-42549 · Severity: medium · CVSS 4.4 · Published 2026-05-13

A vulnerability in the Flight PHP framework's command-line interface allows a local user to create arbitrary directories anywhere on the system. This occurs when a developer or automated process uses the tool to generate new code components. While it cannot directly steal data, it can be used to disrupt operations or prepare a system for more complex multi-stage attacks.

Technologies: FlightPHP Flight, flightphp/core (Packagist). Vendors: FlightPHP, Packagist.

Quick answers

Is CVE-2026-42549 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42549 being exploited in the wild.
How severe is CVE-2026-42549?
Medium severity, with a CVSS score of 4.4, published 13 May 2026.
Which products and versions are affected?
FlightPHP Flight < 3.18.1; flightphp/core (Packagist) < 3.18.1, ECOSYSTEM:introduced=0,fixed=3.18.1.
Is there a fix for CVE-2026-42549?
Yes. flightphp/core (Packagist): upgrade to 3.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42549 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-42549?
Check whether you run FlightPHP Flight or flightphp/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • flightphp/core (Packagist): upgrade to 3.18.1 or later
    composer require flightphp/core:^3.18.1

Technical details

A path traversal vulnerability exists in the `make:controller` command within `flight/commands/ControllerCommand.php`. The application calls `mkdir()` with the `recursive` flag on a path derived from user-supplied input before validating the class name. While the subsequent file-write operation is blocked by Nette's validation, the directory creation occurs as a side effect. A local attacker with access to the CLI can use `../` sequences to create arbitrary directories outside the project root. This can be leveraged for log-file planting or as a primitive in chained Local File Inclusion (LFI) attacks. The issue is fixed in version 3.18.1 by normalizing input with `basename()` and implementing regex validation.

Affected products

  • flightphp core < 3.18.1

Identifiers

  • CVE-2026-42549
  • GHSA-3xjv-pmf2-gf2q

Timeline

  • 2026-04-29: disclosed: Initial disclosure in flightphp/core
  • 2026-05-06: advisory: GitHub Advisory published
  • 2026-05-13: other: NVD published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.