Use Github to securely report the vulnerability.
{{ message }}
Repository navigation
Security: flightphp/core
Security
SECURITY.md
-
Path traversal in Flight::render() leads to RCE via View::getTemplate()GHSA-w8xv-jp8h-m783 published
Oct 7, 2026 by n0nag0nCritical -
Stored/Reflected XSS via `View::e()` on < PHP 8.1GHSA-r8g9-m376-w889 published
Sep 4, 2026 by n0nag0nHigh -
flight.allow_method_override` is applied after the Request is built, so the override stays enabledGHSA-vr9m-jx6f-hhj6 published
Aug 11, 2026 by n0nag0nHigh -
Path traversal in `make:controller` CLI creates arbitrary directories outside project rootGHSA-3xjv-pmf2-gf2q published
Apr 29, 2026 by n0nag0nModerate -
SQL Injection via unvalidated identifiers in SimplePdo::insert / update / deleteGHSA-xwqr-rcqg-22mr published
Apr 29, 2026 by n0nag0nHigh -
HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/coreGHSA-vxrr-w42w-w76g published
Apr 29, 2026 by n0nag0nHigh -
Sensitive information disclosure via default error handler in flightphp/coreGHSA-qrch-52m5-vv85 published
Apr 29, 2026 by n0nag0nHigh -
Reflected XSS via unvalidated JSONP callback in Flight::jsonp()GHSA-fcx8-ph5r-mxr4 published
Apr 29, 2026 by n0nag0nHigh
Learn more about advisories related to flightphp/core in the GitHub Advisory Database