CVE-2026-42550 Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Attackers can inject arbitrary SQL via malicious array keys in Flight framework database operations, potentially reading or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42550?
CVE-2026-42550 is a high-severity SQL injection vulnerability in flightphp core, published on 13 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.
Weakness: CWE-89
Which versions are affected by CVE-2026-42550?
2 open source packages ship an affected version, including flightphp/core.
| Package | Affected | Fixed in |
|---|---|---|
flightphp/core Packagist | All versions | 3.18.1 |
flightphp/core Packagist | All versions | 3.18.1 |
How do I fix CVE-2026-42550?
Upgrade flightphp/core to 3.18.1 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-42550 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42550 exists.
Sources
Also known as GHSA-xwqr-rcqg-22mr.