Threats affecting pkg:github/flightphp/core

FlightPHP versions prior to 3.18.1 contain a vulnerability where the Request::getMethod() function unconditionally trusts the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter for all HTTP verbs, including safe ones like GET. This allows an attacker to change the HTTP method of a request silently, potentially turning a GET request into a DELETE or PUT. This behavior can lead to Cross-Site Request Forgery (CSRF) escalation against destructive endpoints, bypass middleware protections based on HTTP verbs, and cause cache poisoning between CDN and origin. The issue is fixed in version 3.18.1.

FlightPHP core versions prior to 3.18.1 contain a reflected cross-site scripting (XSS) vulnerability in the Flight::jsonp() function. This occurs because the ? jsonp= query parameter is concatenated directly into a JavaScript response without validating that it is a legal JavaScript identifier. An attacker can exploit this to inject arbitrary JavaScript code that executes in the context of the response origin. The vulnerability is assigned CVE-2026-42548 and has a high severity score of 8.6. The issue is fixed in FlightPHP version 3.18.