CVE-2026-42549 — Flight is an extensible micro-framework for PHP. Prior to

title: CVE-2026-42549 - Flight PHP Framework Controller Creation Path Traversal
id: scw-2026-05-13-ai-1
status: experimental
level: high
description: |
  Detects the use of the 'make:controller' command in the Flight PHP framework with a controller name that includes '../' sequences. This indicates an attempt to exploit CVE-2026-42549, where the framework recursively creates directories outside the project root before validating the input, potentially leading to arbitrary directory creation.
author: SCW Feed Engine (AI-generated)
date: 2026-05-13
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42549/
tags:
  - attack.privilege_escalation
  - attack.t1087.001
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'php.exe'
      CommandLine|contains:
          - 'artisan make:controller'
      CommandLine|contains:
          - '../'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse