The vulnerability in FlightPHP core prior to version 3.18.1 arises from the Request::getMethod() method honoring the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter without any opt-in mechanism or whitelist of allowed methods. This flaw allows any HTTP verb, including safe ones like GET, to be overridden to unsafe methods such as DELETE or PUT. Consequently, this can enable attackers to escalate CSRF attacks against endpoints that perform destructive actions, bypass middleware that restricts unsafe HTTP verbs, and poison caches between CDN and origin servers. The vulnerability is identified as CWE-436 (Interpretation Conflict). It has a CVSS 3.1 score of 7.5 (high severity) with no privileges or user interaction required for exploitation. The vulnerability is fixed in FlightPHP version 3.18.1.

An attacker can exploit this vulnerability to escalate CSRF attacks by converting safe HTTP requests into unsafe ones (e.g., GET to DELETE or PUT), potentially causing unauthorized destructive actions. Middleware protections that rely on HTTP verb checks can be bypassed, and cache poisoning attacks between CDN and origin servers are possible. There is no confidentiality impact reported, but integrity is highly impacted. Availability is not affected. No known exploits in the wild have been reported.

Upgrade FlightPHP to version 3.18.1 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 3.18.1, applying this official patch is the recommended remediation. No alternative mitigations or temporary fixes are indicated in the available data.