The vulnerability (CVE-2026-42549) exists in FlightPHP core before version 3.18.1. The make:controller CLI command uses mkdir with recursive directory creation on a path derived from user input without prior validation. While Nette's class-name validation prevents writing class files with invalid names containing '/', the recursive directory creation occurs beforehand, enabling attackers to create directories outside the project root through path traversal sequences like '../'. This improper limitation of pathname to a restricted directory (CWE-22) can lead to unintended directory creation, potentially impacting system availability or integrity. The vulnerability has a CVSS 3.1 score of 4.4 (medium severity) and is fixed in FlightPHP 3.18.1.

The vulnerability allows an attacker with local privileges to cause recursive directory creation outside the intended project directory by supplying crafted controller names with path traversal sequences. This can lead to unintended directory structures on the filesystem, potentially causing denial of service or interference with system operations. There is no direct confidentiality impact, and the class file write is blocked by validation. No known exploits are reported in the wild.

Upgrade FlightPHP core to version 3.18.1 or later, where this vulnerability is fixed. Since the issue is resolved in this version, no additional mitigation steps are required.