What is the CVSS score of CVE-2026-42549?

CVE-2026-42549 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42549?

Yes, a patch is available for CVE-2026-42549. Update the affected software to the latest version immediately.

FlightPHP Runway CVE-2026-42549

MEDIUM

Path Traversal (CWE-22)

2026-05-06 https://github.com/flightphp/core

GHSA-3xjv-pmf2-gf2q

PHP Path Traversal Microsoft

4.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

3.3 LOW

Local CLI invocation requires low privilege; directory creation has no confidentiality or meaningful availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:14 vuln.today

Analysis Generated

Jul 23, 2026 - 23:14 vuln.today

CVE Published

May 06, 2026 - 21:34 nvd

MEDIUM 4.4

DescriptionGitHub Advisory

Summary

The make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed - including directories located outside the project root through ../ traversal.

Affected code

flight/commands/ControllerCommand.php (≈ 63-66):

php

if (is_dir(dirname($controllerPath)) === false) {
    $io->info('Creating directory ' . dirname($controllerPath), true);
    mkdir(dirname($controllerPath), 0755, true);   // un-normalized, runs before validation
}

Proof of concept

$ php vendor/flightphp/runway/runway make:controller '../../../../tmp/CONTROLLER_TRAVERSAL_TEST/pwn'
Creating directory .../app/controllers/../../../../tmp/CONTROLLER_TRAVERSAL_TEST
Nette\InvalidArgumentException: Value '../../../../tmp/CONTROLLER_TRAVERSAL_TEST/pwnController' is not valid class name.

$ ls /home/user/tmp/CONTROLLER_TRAVERSAL_TEST
(directory exists - created before the exception was thrown)

Impact

Arbitrary directory creation outside the project root, executable by any local actor that can run the Flight CLI (developer machine, shared CI build agent, compromised dev container).
Primes log-file planting for chained LFI exploitation (e.g. creating a directory where an attacker can later drop a .php file to be included via a distinct template-include weakness).
On Windows, the \ separator opens additional traversal surface.

Patch (fixed in `3.18.1`, commit `b8dd23a`)

The controller name is now normalized with basename() and validated against ^[A-Za-z_][A-Za-z0-9_]*$ before any mkdir side effect runs.

Credit

Discovered by @Rootingg.

AnalysisAI

Arbitrary directory creation outside the project root is possible in FlightPHP's make:controller CLI command (flightphp/core < 3.18.1) due to un-normalized path handling before input validation. The mkdir(..., recursive: true) call executes on attacker-controlled path segments - including ../ traversal sequences - before Nette's class-name validation can reject the input, leaving the created directories as a committed filesystem side effect. A publicly available proof-of-concept confirms the issue; exploitation is local and no CISA KEV entry exists, consistent with the low EPSS score of 0.02% (5th percentile).

Technical ContextAI

The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). Affected code resides in flight/commands/ControllerCommand.php (≈ lines 63-66) within the Composer package flightphp/core (CPE: pkg:composer/flightphp_core). PHP's mkdir() with the recursive: true flag will create the full directory tree for any supplied path, including paths containing ../ traversal components, without normalizing or canonicalizing the input first. Nette's class-name validator correctly rejects the file-write step when the controller name contains /, but by that point mkdir has already committed the directory structure to disk. On Windows hosts, the \ separator exposes additional traversal surface beyond the ../ Unix-style vector. The fix in 3.18.1 (commit b8dd23a) applies basename() normalization and enforces a strict ^[A-Za-z_][A-Za-z0-9_]*$ regex before any filesystem side effect is allowed to run.

RemediationAI

The primary fix is to upgrade flightphp/core to version 3.18.1 or later via Composer (composer update flightphp/core); this is the vendor-confirmed patched version (commit b8dd23a, advisory: https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q). If an immediate upgrade is not feasible, restrict filesystem permissions so that the PHP process executing the CLI cannot write outside the project root directory (e.g., run the CLI under a user whose home/working directory is chroot-equivalent or confined by OS-level controls). In CI environments, ensure the build user's write permissions are scoped to the project workspace only, which would contain the traversal impact. Avoid passing unsanitized, user-controlled strings as the controller name argument in automated pipelines. There is no configuration flag to disable the vulnerable code path short of patching, since the mkdir call is unconditional in the affected versions.