Read the docs
TI-2026-30829 Aliases CVE-2026-42549GHSA-3xjv-pmf2-gf2q

Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root

Priority MEDIUM 54CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Fix Fixed core (flightphp): 3.18.1flightphp/core (Packagist): 3.18.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flightphpcorebefore 3.18.13.18.1Patch availableCNA
—flightphp/core (Packagist)before 3.18.13.18.1Patch availableGHSA-3xjv-pmf2-gf2q
  • core Vendorflightphp Affected before 3.18.1 Fixed in 3.18.1 Patch available CNA
  • flightphp/core (Packagist) Vendor— Affected before 3.18.1 Fixed in 3.18.1 Patch available GHSA-3xjv-pmf2-gf2q

Remediation

  • Fix · CNA core (flightphp) Fixed in 3.18.1
  • Fix · GHSA-3xjv-pmf2-gf2q flightphp/core (Packagist) Fixed in 3.18.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42549
  2. 2026-10-03 Alias added: GHSA-3xjv-pmf2-gf2q

References

Advisory 1

Other 2

  • TI-2026-30828 Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp() CVSS 4.0HIGH 8.6
  • TI-2026-30830 Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete CVSS 3.1HIGH 8.8
  • TI-2026-30832 Flight: Sensitive information disclosure via default error handler in flightphp/core CVSS 3.1HIGH 7.5
  • TI-2026-30831 Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core CVSS 3.1HIGH 7.5
  • TI-2014-08426 Denial of Service (DoS) vulnerability in mikecao/flight CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences