Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
> 3.18.0	✅
<= 2.0	❌

Reporting a Vulnerability

Use Github to securely report the vulnerability.

Path traversal in `make:controller` CLI creates arbitrary directories outside project root
GHSA-3xjv-pmf2-gf2q published Apr 29, 2026 by n0nag0n

Moderate
SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
GHSA-xwqr-rcqg-22mr published Apr 29, 2026 by n0nag0n

High
HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core
GHSA-vxrr-w42w-w76g published Apr 29, 2026 by n0nag0n

High
Sensitive information disclosure via default error handler in flightphp/core
GHSA-qrch-52m5-vv85 published Apr 29, 2026 by n0nag0n

High
Reflected XSS via unvalidated JSONP callback in Flight::jsonp()
GHSA-fcx8-ph5r-mxr4 published Apr 29, 2026 by n0nag0n

High

Learn more about advisories related to flightphp/core in the GitHub Advisory Database