CVE-2026-42549 Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root
Attackers can create arbitrary directories outside the project root via path traversal in the make:controller CLI command.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42549?
CVE-2026-42549 is a medium-severity path traversal vulnerability in flightphp core, published on 13 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-42549?
2 open source packages ship an affected version, including flightphp/core.
| Package | Affected | Fixed in |
|---|---|---|
flightphp/core Packagist | All versions | 3.18.1 |
flightphp/core Packagist | All versions | 3.18.1 |
How do I fix CVE-2026-42549?
Upgrade flightphp/core to 3.18.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-42549 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42549 exists.
Sources
Also known as GHSA-3xjv-pmf2-gf2q.