CVE-2026-42549

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42549", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-28T16:56:50.191Z", "datePublished": "2026-05-13T19:22:20.932Z", "dateUpdated": "2026-05-14T19:52:29.945Z"}, "containers": {"cna": {"title": "Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q"}], "affected": [{"vendor": "flightphp", "product": "core", "versions": [{"version": "< 3.18.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-13T19:22:20.932Z"}, "descriptions": [{"lang": "en", "value": "Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed \u2014 including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1."}], "source": {"advisory": "GHSA-3xjv-pmf2-gf2q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T19:05:05.835731Z", "id": "CVE-2026-42549", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T19:52:29.945Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42549", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T19:05:05.835731Z"}}}], "references": [{"url": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T19:05:13.288Z"}}], "cna": {"title": "Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root", "source": {"advisory": "GHSA-3xjv-pmf2-gf2q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "flightphp", "product": "core", "versions": [{"status": "affected", "version": "< 3.18.1"}]}], "references": [{"url": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q", "name": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed \u2014 including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-13T19:22:20.932Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42549", "state": "PUBLISHED", "dateUpdated": "2026-05-14T19:52:29.945Z", "dateReserved": "2026-04-28T16:56:50.191Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-13T19:22:20.932Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "core", "vendor": "flightphp", "versions": [{"status": "affected", "version": "< 3.18.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed \u2014 including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1."}, {"lang": "es", "value": "Flight es un micro-framework extensible para PHP. Antes de 3.18.1, el comando CLI make:controller llama a mkdir(..., recursive: true) en una ruta construida a partir del nombre de controlador proporcionado por el usuario, antes de que se ejecute la validaci\u00f3n de nombres de clase de Nette. La escritura del archivo de clase es correctamente rechazada por Nette cuando el nombre contiene /, pero el efecto secundario de creaci\u00f3n recursiva de directorios ya est\u00e1 comprometido - incluyendo directorios ubicados fuera de la ra\u00edz del proyecto a trav\u00e9s del recorrido .. / . Esta vulnerabilidad est\u00e1 corregida en 3.18.1."}], "id": "CVE-2026-42549", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42549", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T19:05:05.835731Z", "version": "2.0.3"}}]}, "published": "2026-05-13T20:16:21.927", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.18.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "core", "source": "cna", "vendor": "flightphp"}, "product": "core", "vendor": "flightphp"}], "created": "2026-05-13T22:45:06.116276+00:00", "updated": "2026-05-14T14:33:40.691882+00:00", "vendors": ["flightphp", "flightphp$PRODUCT$core"]}