Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|
References
History
Wed, 13 May 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal. This vulnerability is fixed in 3.18.1. | |
| Title | Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root | |
| Weaknesses | CWE-22 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-05-13T19:22:20.932Z
Reserved: 2026-04-28T16:56:50.191Z
Link: CVE-2026-42549
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-13T20:16:21.927
Modified: 2026-05-13T20:16:21.927
Link: CVE-2026-42549
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-13T22:45:06Z