https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T10:03:50.633626+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-42551 CVE-2026-42551 — Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core 2026-10-08T10:03:50.659244+00:00

Affected: flightphp core

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.