Vulnerability-Lookup

GHSA-3XJV-PMF2-GF2Q

Vulnerability from github – Published: 2026-05-06 21:34 – Updated: 2026-05-14 20:39

Summary

Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root

Details

Summary

The make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal.

Affected code

flight/commands/ControllerCommand.php (≈ 63-66):

if (is_dir(dirname($controllerPath)) === false) {
    $io->info('Creating directory ' . dirname($controllerPath), true);
    mkdir(dirname($controllerPath), 0755, true);   // un-normalized, runs before validation
}

Proof of concept

$ php vendor/flightphp/runway/runway make:controller '../../../../tmp/CONTROLLER_TRAVERSAL_TEST/pwn'
Creating directory .../app/controllers/../../../../tmp/CONTROLLER_TRAVERSAL_TEST
Nette\InvalidArgumentException: Value '../../../../tmp/CONTROLLER_TRAVERSAL_TEST/pwnController' is not valid class name.

$ ls /home/user/tmp/CONTROLLER_TRAVERSAL_TEST
(directory exists — created before the exception was thrown)

Impact

Arbitrary directory creation outside the project root, executable by any local actor that can run the Flight CLI (developer machine, shared CI build agent, compromised dev container).
Primes log-file planting for chained LFI exploitation (e.g. creating a directory where an attacker can later drop a .php file to be included via a distinct template-include weakness).
On Windows, the \ separator opens additional traversal surface.

Patch (fixed in `3.18.1`, commit `b8dd23a`)

The controller name is now normalized with basename() and validated against ^[A-Za-z_][A-Za-z0-9_]*$ before any mkdir side effect runs.

Credit

Discovered by @Rootingg.

Severity

4.4 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "flightphp/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42549"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T21:34:39Z",
    "nvd_published_at": "2026-05-13T20:16:21Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe `make:controller` CLI command calls `mkdir(..., recursive: true)` on a path built from the user-supplied controller name, **before** Nette\u0027s class-name validation runs. The class-file write is correctly rejected by Nette when the name contains `/`, but the recursive directory creation side effect is already committed \u2014 including directories located outside the project root through `../` traversal.\n\n### Affected code\n`flight/commands/ControllerCommand.php` (\u2248 63-66):\n\n```php\nif (is_dir(dirname($controllerPath)) === false) {\n    $io-\u003einfo(\u0027Creating directory \u0027 . dirname($controllerPath), true);\n    mkdir(dirname($controllerPath), 0755, true);   // un-normalized, runs before validation\n}\n```\n\n### Proof of concept\n```\n$ php vendor/flightphp/runway/runway make:controller \u0027../../../../tmp/CONTROLLER_TRAVERSAL_TEST/pwn\u0027\nCreating directory .../app/controllers/../../../../tmp/CONTROLLER_TRAVERSAL_TEST\nNette\\InvalidArgumentException: Value \u0027../../../../tmp/CONTROLLER_TRAVERSAL_TEST/pwnController\u0027 is not valid class name.\n\n$ ls /home/user/tmp/CONTROLLER_TRAVERSAL_TEST\n(directory exists \u2014 created before the exception was thrown)\n```\n\n### Impact\n- **Arbitrary directory creation outside the project root**, executable by any local actor that can run the Flight CLI (developer machine, shared CI build agent, compromised dev container).\n- Primes log-file planting for chained LFI exploitation (e.g. creating a directory where an attacker can later drop a `.php` file to be included via a distinct template-include weakness).\n- On Windows, the `\\` separator opens additional traversal surface.\n\n### Patch (fixed in `3.18.1`, commit `b8dd23a`)\nThe controller name is now normalized with `basename()` and validated against `^[A-Za-z_][A-Za-z0-9_]*$` before any `mkdir` side effect runs.\n\n### Credit\nDiscovered by **@Rootingg**.",
  "id": "GHSA-3xjv-pmf2-gf2q",
  "modified": "2026-05-14T20:39:56Z",
  "published": "2026-05-06T21:34:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42549"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/flightphp/core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root"
}

CVE-2026-42549 (GCVE-0-2026-42549)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:22 – Updated: 2026-05-14 19:52

Title

Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root

Summary

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/flightphp/core/security/adviso…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
flightphp	core	Affected: < 3.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42549",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T19:05:05.835731Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T19:52:29.945Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "flightphp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette\u0027s class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed \u2014 including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:22:20.932Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/flightphp/core/security/advisories/GHSA-3xjv-pmf2-gf2q"
        }
      ],
      "source": {
        "advisory": "GHSA-3xjv-pmf2-gf2q",
        "discovery": "UNKNOWN"
      },
      "title": "Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42549",
    "datePublished": "2026-05-13T19:22:20.932Z",
    "dateReserved": "2026-04-28T16:56:50.191Z",
    "dateUpdated": "2026-05-14T19:52:29.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-3XJV-PMF2-GF2Q

Summary

Affected code

Proof of concept

Impact

Patch (fixed in 3.18.1, commit b8dd23a)

Credit

CVE-2026-42549 (GCVE-0-2026-42549)

Tags

Sightings

Nomenclature

Patch (fixed in `3.18.1`, commit `b8dd23a`)