CVE-2026-42550: Flight PHP SQL injection in SimplePdo database helper

CVE-2026-42550 · Severity: high · CVSS 8.8 · Published 2026-05-13

The Flight PHP framework contains a vulnerability in its database helper component that could allow an attacker to execute unauthorized database commands. By sending specially crafted data to applications using this framework, an attacker could gain administrative privileges, modify sensitive records, or delete entire database tables. This poses a significant risk to data integrity and confidentiality for any application built on the affected versions of the framework.

Technologies: FlightPHP Flight, flightphp/core (Packagist). Vendors: FlightPHP, Packagist.

Quick answers

Is CVE-2026-42550 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42550 being exploited in the wild.
How severe is CVE-2026-42550?
High severity, with a CVSS score of 8.8, published 13 May 2026.
Which products and versions are affected?
FlightPHP Flight < 3.18.1; flightphp/core (Packagist) < 3.18.1, ECOSYSTEM:introduced=0,fixed=3.18.1.
Is there a fix for CVE-2026-42550?
Yes. flightphp/core (Packagist): upgrade to 3.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42550 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42550?
Check whether you run FlightPHP Flight or flightphp/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • flightphp/core (Packagist): upgrade to 3.18.1 or later
    composer require flightphp/core:^3.18.1

Technical details

A SQL injection vulnerability exists in the `SimplePdo` class of the Flight PHP framework. The `insert()`, `update()`, and `delete()` methods construct SQL statements by directly concatenating table names and array keys from the `$data` parameter without proper identifier quoting or validation. An attacker can exploit this by providing malicious array keys (e.g., via JSON input) that break out of the intended SQL structure. This can lead to privilege escalation, arbitrary data modification, or data exfiltration. The issue is fixed in version 3.18.1 by introducing a `requireSafeIdentifier()` helper that validates identifiers against a strict alphanumeric pattern.

Affected products

  • FlightPHP Flight (flightphp/core) < 3.18.1

Identifiers

  • CVE-2026-42550
  • GHSA-xwqr-rcqg-22mr

Timeline

  • 2026-04-29: disclosed: Vulnerability reported and reviewed on GitHub
  • 2026-04-29: patched: Fixed in version 3.18.1 via commit b8dd23a
  • 2026-05-06: advisory: GitHub Advisory GHSA-xwqr-rcqg-22mr published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.