CVE-2026-42551
HighSummary
The Flight framework for PHP prior to version 3.18.1 has a vulnerability that allows unconditionally honoring the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter for any HTTP verbs, including safe ones like GET. This can lead to CSRF escalation and bypassing security measures based on unsafe verbs.
Risk Assessment
Organizations may be exposed to CSRF attacks that could result in unauthorized operations on sensitive endpoints and cache poisoning between CDN and origin servers.
Recommendation
It is recommended to upgrade to version 3.18.1 or later to mitigate this vulnerability and implement additional security measures to restrict HTTP method manipulation.
Other vulnerabilities in Flight framework for PHP
Original NVD description (English source)
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.