TI-2026-30830 Aliases CVE-2026-42550 GHSA-xwqr-rcqg-22mr

Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete

HIGH 73CWE-89Published 2026-05-13 · Updated 2026-05-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00455 39th percentileScored 2026-11-07

Fix Fixed core (flightphp): 3.18.1flightphp/core (Packagist): 3.18.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
flightphp	core	before 3.18.1	3.18.1	Patch available	CNA
—	flightphp/core (Packagist)	before 3.18.1	3.18.1	Patch available	GHSA-xwqr-rcqg-22mr

core Vendorflightphp Affected before 3.18.1 Fixed in 3.18.1 Patch available CNA
flightphp/core (Packagist) Vendor— Affected before 3.18.1 Fixed in 3.18.1 Patch available GHSA-xwqr-rcqg-22mr

Remediation

Fix · CNA core (flightphp) Fixed in 3.18.1
Fix · GHSA-xwqr-rcqg-22mr flightphp/core (Packagist) Fixed in 3.18.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-42550
2026-10-03 Alias added: GHSA-xwqr-rcqg-22mr

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-42550

Other 4

TI-2026-30828 Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp() CVSS 4.0HIGH 8.6
TI-2026-30832 Flight: Sensitive information disclosure via default error handler in flightphp/core CVSS 3.1HIGH 7.5
TI-2026-30831 Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core CVSS 3.1HIGH 7.5
TI-2014-08426 Denial of Service (DoS) vulnerability in mikecao/flight CVSS 3.1HIGH 7.5
TI-2026-30829 Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root CVSS 3.1MEDIUM 4.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences