Vulnerability · Published May 13, 2026 · Assigned by GitHub_M
CVE-2026-42550Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
High 8.8
In plain English
A high-severity SQL injection in core from flightphp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert('users', $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | flightphp/core | 3.18.1 | GHSA-xwqr-rcqg-22mr |
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/flightphp/core/security/advisories/GHSA-xwqr-rcqg-22mr x_refsource_CONFIRM