Skip to content
OpenAdvisories

Vendor

flightphp

6 known vulnerabilities.

Products

core 6
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.4
    CVE-2026-42549

    Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root

    Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is corr…

    flightphp core flightphp/core Packagist