Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

flightphp/core lets GET requests change to destructive actions

CVE-2026-42551 · published 5 months ago
Summary

The Flight PHP micro‑framework automatically accepts the X‑HTTP‑Method‑Override header and a special request parameter, even on safe GET requests. This means a simple GET can be turned into a DELETE or PUT request, allowing attackers to perform actions they shouldn't be able to, such as deleting data or bypassing security checks. Upgrade to version 3.18.1 or later, which disables this behavior by default.

What to do
  • Update flightphp core to version 3.18.1.
Affected software
Ecosystem VendorProductAffected versions
composer flightphp core < 3.18.1
Fix: upgrade to 3.18.1
Original advisory text
Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-436Interpretation Conflict
Timeline
Published13 May 2026
Updated4 Nov 2026
First seen6 May 2026
Sources
GHSA-vxrr-w42w-w76g · GHSA
CVE-2026-42551 · NVD
CVE-2026-42551 · OSV
Track software like this
Free during beta