CVE-2026-42549 is a path traversal vulnerability (CWE-22) in FlightPHP core before version 3.18.1. The vulnerability arises because the make:controller CLI command calls mkdir with recursive directory creation on a path derived from user input without prior validation. While Nette's class-name validation prevents writing files with invalid names containing '/', it does not prevent the creation of directories outside the intended scope via '../' traversal. This can lead to unintended directory creation outside the project root. The vulnerability has a CVSS 3.1 base score of 4.4, indicating medium severity. The issue is resolved in FlightPHP version 3.18.1.

The vulnerability allows an attacker with local privileges to cause the application to create directories outside the intended project root directory via path traversal in the make:controller CLI command. This may lead to unintended filesystem modifications and potential denial of service due to directory creation in unauthorized locations. There is no direct confidentiality impact, but integrity and availability impacts are possible. No known exploits are reported in the wild.

Upgrade FlightPHP core to version 3.18.1 or later, where this vulnerability is fixed. Since the vulnerability is resolved in this version, no additional mitigation actions are required.