# CVE-2026-42551: Flight PHP HTTP method override in Request::getMethod

Source: https://junglewise.ai/threats/cve-2026-42551-flight-php-http-method-override-in-request-getmethod  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42551 · Severity: high · CVSS 7.5 · Published 2026-05-13

The Flight PHP framework contains a vulnerability where it incorrectly processes web requests by allowing them to be 'redefined' as different actions (like changing a view request into a delete request). This could allow an attacker to perform destructive actions on a website, such as deleting data, by tricking a user's browser or bypassing security filters. This impact can lead to unauthorized data modification and potential service disruption.

Technologies: [FlightPHP Flight](https://junglewise.ai/threats/technologies/flight), [flightphp/core (Packagist)](https://junglewise.ai/threats/technologies/flightphp-core). Vendors: [FlightPHP](https://junglewise.ai/threats/vendors/flightphp), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-42551 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42551 being exploited in the wild.

**How severe is CVE-2026-42551?** High severity, with a CVSS score of 7.5, published 13 May 2026.

**Which products and versions are affected?** FlightPHP Flight < 3.18.1; flightphp/core (Packagist) < 3.18.1, ECOSYSTEM:introduced=0,fixed=3.18.1.

**Is there a fix for CVE-2026-42551?** Yes. flightphp/core (Packagist): upgrade to 3.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42551 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42551?** Check whether you run FlightPHP Flight or flightphp/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- flightphp/core (Packagist): upgrade to 3.18.1 or later

  ```sh
  composer require flightphp/core:^3.18.1
  ```


## Technical details

The `Request::getMethod()` function in `flight/net/Request.php` unconditionally honors the `X-HTTP-Method-Override` header and the `$_REQUEST['_method']` parameter. Because `$_REQUEST` can include parameters from GET requests, an attacker can trigger unsafe HTTP methods (PUT, DELETE, PATCH) using a simple GET request. This facilitates Cross-Site Request Forgery (CSRF) without requiring JavaScript, as a simple `<img>` tag can trigger a destructive action. Additionally, this behavior can be used to bypass middleware that only inspects unsafe verbs or to cause CDN cache poisoning. The issue is fixed in version 3.18.1 by introducing the `flight.allow_method_override` setting, which is disabled by default.

## Affected products

- flightphp core < 3.18.1

## Identifiers

- CVE-2026-42551
- GHSA-vxrr-w42w-w76g

## Timeline

- 2026-04-29: disclosed: Initial disclosure to flightphp/core
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-13: other: NVD publication date

## References

- [https://api.github.com/users/Rootingg](https://api.github.com/users/Rootingg)
- [https://github.com/Rootingg](https://github.com/Rootingg)
- [https://api.github.com/users/Rootingg/gists%7B/gist_id%7D](https://api.github.com/users/Rootingg/gists%7B/gist_id%7D)
- [https://api.github.com/users/Rootingg/repos](https://api.github.com/users/Rootingg/repos)
- [https://avatars.githubusercontent.com/u/91620858?v=4](https://avatars.githubusercontent.com/u/91620858?v=4)
- [https://api.github.com/users/Rootingg/events%7B/privacy%7D](https://api.github.com/users/Rootingg/events%7B/privacy%7D)

## Related threats

- [Flight PHP sensitive information disclosure in default error handler](https://junglewise.ai/threats/cve-2026-42552-flight-php-sensitive-information-disclosure-in-default-error)
- [Flight PHP SQL injection in SimplePdo database helper](https://junglewise.ai/threats/cve-2026-42550-flight-php-sql-injection-in-simplepdo-database-helper)
- [Flight PHP path traversal in make:controller CLI command](https://junglewise.ai/threats/cve-2026-42549-flight-php-path-traversal-in-make-controller-cli-command)
- [FlightPHP Flight reflected XSS in Flight::jsonp callback](https://junglewise.ai/threats/cve-2026-42548-flightphp-flight-reflected-xss-in-flight-jsonp-callback)