CVE-2026-42549: falha de média gravidade em flightphp core
Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.4epss 0.2%
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
flightphp · coreCVEs relacionadas — flightphp core
No mesmo produto, das mais perigosas para as menos.
CVE-2026-42550HIGHFlight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / deleteEPSS 0.5%CVE-2014-125127HIGHDenial of Service (DoS) vulnerability in mikecao/flightEPSS 0.5%CVE-2026-42548HIGHFlight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()EPSS 0.4%CVE-2026-42551HIGHFlight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/coreEPSS 0.4%CVE-2026-42552HIGHFlight: Sensitive information disclosure via default error handler in flightphp/coreEPSS 0.3%