Security Advisory

CVE-2026-42551

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-13 19:23:27

Last updated 2026-05-14 12:49:48

Assigner GitHub_M

CVSS score 7.5

State PUBLISHED

Description

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.

← Browse all CVEs View on cve.org ↗