CVE-2026-42549: Flight PHP path traversal in make:controller CLI command

Executive brief

A vulnerability in the Flight PHP framework's command-line interface allows a local user to create arbitrary directories anywhere on the system. This occurs when a developer or automated process uses the tool to generate new code components. While it cannot directly steal data, it can be used to disrupt operations or prepare a system for more complex multi-stage attacks.

Technical details

A path traversal vulnerability exists in the `make:controller` command within `flight/commands/ControllerCommand.php`. The application calls `mkdir()` with the `recursive` flag on a path derived from user-supplied input before validating the class name. While the subsequent file-write operation is blocked by Nette's validation, the directory creation occurs as a side effect. A local attacker with access to the CLI can use `../` sequences to create arbitrary directories outside the project root. This can be leveraged for log-file planting or as a primitive in chained Local File Inclusion (LFI) attacks. The issue is fixed in version 3.18.1 by normalizing input with `basename()` and implementing regex validation.

Affected products

• flightphp core < 3.18.1

Timeline

• 2026-04-29: disclosed: Initial disclosure in flightphp/core
• 2026-05-06: advisory: GitHub Advisory published
• 2026-05-13: other: NVD published

References

• https://api.github.com/users/Rootingg
• https://github.com/Rootingg
• https://api.github.com/users/Rootingg/gists%7B/gist_id%7D
• https://api.github.com/users/Rootingg/repos
• https://avatars.githubusercontent.com/u/91620858?v=4
• https://api.github.com/users/Rootingg/events%7B/privacy%7D