# CVE-2026-42549: Flight PHP path traversal in make:controller CLI command

Source: https://junglewise.ai/threats/cve-2026-42549-flight-php-path-traversal-in-make-controller-cli-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42549 · Severity: medium · CVSS 4.4 · Published 2026-05-13

A vulnerability in the Flight PHP framework's command-line interface allows a local user to create arbitrary directories anywhere on the system. This occurs when a developer or automated process uses the tool to generate new code components. While it cannot directly steal data, it can be used to disrupt operations or prepare a system for more complex multi-stage attacks.

Technologies: [FlightPHP Flight](https://junglewise.ai/threats/technologies/flight), [flightphp/core (Packagist)](https://junglewise.ai/threats/technologies/flightphp-core). Vendors: [FlightPHP](https://junglewise.ai/threats/vendors/flightphp), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-42549 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42549 being exploited in the wild.

**How severe is CVE-2026-42549?** Medium severity, with a CVSS score of 4.4, published 13 May 2026.

**Which products and versions are affected?** FlightPHP Flight < 3.18.1; flightphp/core (Packagist) < 3.18.1, ECOSYSTEM:introduced=0,fixed=3.18.1.

**Is there a fix for CVE-2026-42549?** Yes. flightphp/core (Packagist): upgrade to 3.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42549 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-42549?** Check whether you run FlightPHP Flight or flightphp/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- flightphp/core (Packagist): upgrade to 3.18.1 or later

  ```sh
  composer require flightphp/core:^3.18.1
  ```


## Technical details

A path traversal vulnerability exists in the `make:controller` command within `flight/commands/ControllerCommand.php`. The application calls `mkdir()` with the `recursive` flag on a path derived from user-supplied input before validating the class name. While the subsequent file-write operation is blocked by Nette's validation, the directory creation occurs as a side effect. A local attacker with access to the CLI can use `../` sequences to create arbitrary directories outside the project root. This can be leveraged for log-file planting or as a primitive in chained Local File Inclusion (LFI) attacks. The issue is fixed in version 3.18.1 by normalizing input with `basename()` and implementing regex validation.

## Affected products

- flightphp core < 3.18.1

## Identifiers

- CVE-2026-42549
- GHSA-3xjv-pmf2-gf2q

## Timeline

- 2026-04-29: disclosed: Initial disclosure in flightphp/core
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-13: other: NVD published

## References

- [https://api.github.com/users/Rootingg](https://api.github.com/users/Rootingg)
- [https://github.com/Rootingg](https://github.com/Rootingg)
- [https://api.github.com/users/Rootingg/gists%7B/gist_id%7D](https://api.github.com/users/Rootingg/gists%7B/gist_id%7D)
- [https://api.github.com/users/Rootingg/repos](https://api.github.com/users/Rootingg/repos)
- [https://avatars.githubusercontent.com/u/91620858?v=4](https://avatars.githubusercontent.com/u/91620858?v=4)
- [https://api.github.com/users/Rootingg/events%7B/privacy%7D](https://api.github.com/users/Rootingg/events%7B/privacy%7D)

## Related threats

- [Flight PHP sensitive information disclosure in default error handler](https://junglewise.ai/threats/cve-2026-42552-flight-php-sensitive-information-disclosure-in-default-error)
- [Flight PHP HTTP method override in Request::getMethod](https://junglewise.ai/threats/cve-2026-42551-flight-php-http-method-override-in-request-getmethod)
- [Flight PHP SQL injection in SimplePdo database helper](https://junglewise.ai/threats/cve-2026-42550-flight-php-sql-injection-in-simplepdo-database-helper)
- [FlightPHP Flight reflected XSS in Flight::jsonp callback](https://junglewise.ai/threats/cve-2026-42548-flightphp-flight-reflected-xss-in-flight-jsonp-callback)