CVE-2026-42551— Flight 安全漏洞

Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

解释冲突

Flight 安全漏洞

Flight是Mike Cao个人开发者的一个PHP微框架。 Flight 3.18.1之前版本存在安全漏洞，该漏洞源于Request::getMethod()无条件接受X-HTTP-Method-Override标头和$_REQUEST[ _method ]参数，可能导致CSRF升级、中间件绕过和缓存投毒。

N/A

N/A