PT-2026-38271 · Flight · Flight

Published 2026-05-06 · Updated 2026-05-13 · CVE-2026-42549

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Flight versions prior to 3.18.1

Description The make:controller CLI command allows arbitrary directory creation outside the project root. This occurs because the command calls mkdir(..., recursive: true) on a path constructed from a user-supplied controller name before class-name validation is performed. While the subsequent class-file write is rejected if the name contains /, the directory creation side effect is already committed, enabling path traversal via ../ sequences. On Windows systems, the `` separator provides an additional traversal surface. This issue can be exploited by local actors with access to the Flight CLI, such as on developer machines or shared CI build agents.

Recommendations Update to version 3.18.1.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-42549

GHSA-3XJV-PMF2-GF2Q

Affected Products

Flight

References · 5

• 🔥 https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q · Exploit
• https://osv.dev/vulnerability/GHSA-3xjv-pmf2-gf2q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42549 · Security Note
• https://github.com/flightphp/core · Note
• https://t.me/CVEtracker/53695 · Telegram Post