Directory Traversal Vulnerability in Flight Micro-Framework for PHP

CVE-2026-42549

What is CVE-2026-42549?

The Flight micro-framework for PHP has a vulnerability in its make:controller CLI command, allowing for directory traversal due to improper handling of user-supplied input. Before version 3.18.1, this command invoked mkdir with recursive creation, potentially allowing the creation of directories outside the intended project root. Although Nette's class-name validation prevents invalid character usage, the recursive nature of directory creation can lead to unauthorized directory access through paths like ../. This vulnerability highlights the importance of validating user input effectively to prevent unauthorized access to the file system.

References