CVE-2026-42549

{
  "id": "CVE-2026-42549",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-13T20:16:21.927",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1."
    },
    {
      "lang": "es",
      "value": "Flight es un micro-framework extensible para PHP. Antes de 3.18.1, el comando CLI make:controller llama a mkdir(..., recursive: true) en una ruta construida a partir del nombre de controlador proporcionado por el usuario, antes de que se ejecute la validación de nombres de clase de Nette. La escritura del archivo de clase es correctamente rechazada por Nette cuando el nombre contiene /, pero el efecto secundario de creación recursiva de directorios ya está comprometido - incluyendo directorios ubicados fuera de la raíz del proyecto a través del recorrido .. / . Esta vulnerabilidad está corregida en 3.18.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "flightphp",
          "product": "core",
          "versions": [
            {
              "version": "< 3.18.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T19:05:05.835731Z",
          "id": "CVE-2026-42549",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}