Threat database

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.

FlightPHP versions prior to 3.18.1 contain a vulnerability where the Request::getMethod() function unconditionally trusts the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter for all HTTP verbs, including safe ones like GET. This allows an attacker to change the HTTP method of a request silently, potentially turning a GET request into a DELETE or PUT. This behavior can lead to Cross-Site Request Forgery (CSRF) escalation against destructive endpoints, bypass middleware protections based on HTTP verbs, and cause cache poisoning between CDN and origin. The issue is fixed in version 3.18.1.

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1.

FlightPHP core versions prior to 3.18.1 contain a reflected cross-site scripting (XSS) vulnerability in the Flight::jsonp() function. This occurs because the ? jsonp= query parameter is concatenated directly into a JavaScript response without validating that it is a legal JavaScript identifier. An attacker can exploit this to inject arbitrary JavaScript code that executes in the context of the response origin. The vulnerability is assigned CVE-2026-42548 and has a high severity score of 8.6. The issue is fixed in FlightPHP version 3.18.