PT-2026-38273 · Flight · Flight

Published 2026-05-06 · Updated 2026-05-13 · CVE-2026-42551

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Flight versions prior to 3.18.1

Description The getMethod() function unconditionally honors the X-HTTP-Method-Override header and the method parameter within the $ REQUEST variable on any HTTP verb, including safe verbs like GET. This occurs without an opt-in mechanism or a whitelist of permitted target methods. Consequently, a GET request can be silently converted into a DELETE or PUT request. This behavior enables Cross-Site Request Forgery (CSRF) escalation against destructive endpoints, allows the bypass of middleware restricted to unsafe verbs, and can lead to cache poisoning between a Content Delivery Network (CDN) and the origin server.

Recommendations Update to version 3.18.1. As a temporary mitigation, set the flight.allow method override setting to false to disable both the X-HTTP-Method-Override header and the method parameter.

Exploit

Fix

Weakness Enumeration

CWE-436

Related Identifiers

CVE-2026-42551

GHSA-VXRR-W42W-W76G

Affected Products

Flight

References · 8

• 🔥 https://github.com/flightphp/core/security/advisories/GHSA-vxrr-w42w-w76g · Exploit
• https://osv.dev/vulnerability/GHSA-vxrr-w42w-w76g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42551 · Security Note
• https://github.com/flightphp/core/commit/b8dd23aaa828cb289fa3c84e75b2a3717cab50b0 · Note
• https://github.com/flightphp/core/releases/tag/v3.18.1 · Note
• https://github.com/flightphp/core · Note
• https://t.me/CVEtracker/53697 · Telegram Post
• https://twitter.com/CVEnew/status/2054709243706737031 · Twitter Post