Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The default error handler Engine::error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal). Affected code flight/Engine.php (≈ lines 678-704): No flight.debug check, no environment gating. Proof of concept Any uncaught exception — including those auto-raised from handleError() — returns: Reproduced against the live PoC app at /poc5/error. Impact - Disclosure of absolute filesystem paths (primes weaponization of LFI / path-traversal vulnerabilities in the same application). - Disclosure of secrets (DB credentials, API tokens) when exceptions are constructed with interpolated configuration values. - Enumeration of installed vendor packages and internal application…
Recommended action: Upgrade to 3.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $REQUEST['method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. Affected code flight/net/Request.php (≈ lines 281-292): $REQUEST aggregates $GET and $POST; on PHP runtimes with requestorder=GPC it also includes $COOKIE. Proof of concept is dispatched as DELETE /item/42. is also dispatched as DELETE /item/42. Trivial CSRF vector (no JavaScript required): loaded on any attacker-controlled page triggers the destructive DELETE on page load, bypassing Same-Origin Policy (image loads are not blocked). Reproduced against /poc4/item/42. Impact - GET → DELETE / PUT CSRF on any route registered for unsafe verbs. - Bypass of…
Recommended action: Upgrade to 3.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db-insert('users', $request-data-getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. Affected code flight/database/SimplePdo.php: No identifier-quoting helper exists; neither $table nor the data keys are validated against a safe-identifier pattern. Proof of concept A controller does: The attacker sends the JSON body: Generated SQL: After the -- comment, the effective statement INSERT INTO users (name, isadmin) VALUES (?, 1) binds the single placeholder 'attackerinjected', yielding a row with isadmin = 1. Reproduced live on an in-memory sqlite database (testproj/sqlilive2.php): UPDATE injection via the $where…
Recommended action: Upgrade to 3.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal. Affected code flight/commands/ControllerCommand.php (≈ 63-66): Proof of concept Impact - Arbitrary directory creation outside the project root, executable by any local actor that can run the Flight CLI (developer machine, shared CI build agent, compromised dev container). - Primes log-file planting for chained LFI exploitation (e.g. creating a directory where an attacker can later drop a .php file to be included via a distinct template-include weakness). - On Windows, the \ separator opens additional traversal surface. Patch (fixed in 3.18.1, commit b8dd23a) The controller name is now…
Recommended action: Upgrade to 3.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting. Affected code flight/Engine.php (≈ lines 1000-1013): No regex or identifier validation is performed before the callback is written. Proof of concept Given any route that calls Flight::jsonp($data): Reproduced response (Content-Type: application/javascript): When the vulnerable endpoint is loaded via <script src="https://victim.tld/api?jsonp=…" on a page controlled by the attacker, the injected JavaScript executes in the victim.tld origin whenever that page is embedded or visited in a same-origin context — cookie theft and session hijack follow. Impact - Reflected XSS in any application calling Flight::jsonp(). - Cookie theft / session hijack when JSONP endpoints are referenced…
Recommended action: Upgrade to 3.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.