flightphp/core Security Advisories | GitStock

high2026-05-06

Flight vulnerable to sensitive information disclosure via default error handler

GHSA-qrch-52m5-vv85 · CVE-2026-42552

high2026-05-06

Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass

GHSA-vxrr-w42w-w76g · CVE-2026-42551

high2026-05-06

Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete

GHSA-xwqr-rcqg-22mr · CVE-2026-42550

medium2026-05-06

Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root

GHSA-3xjv-pmf2-gf2q · CVE-2026-42549

high2026-05-06

Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()

GHSA-fcx8-ph5r-mxr4 · CVE-2026-42548