GHSA-3xjv-pmf2-gf2q
MEDIUMGHSA-3xjv-pmf2-gf2q is a medium-severity (CVSS 4.4) vulnerability in flightphp/core. O3 Security confirms whether GHSA-3xjv-pmf2-gf2q is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root
Real-World Exposure
flightphp/coreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect is already committed — including directories located outside the project root through ../ traversal.
Affected code
flight/commands/ControllerCommand.php (≈ 63-66):
if (is_dir(dirname($controllerPath)) === false) {
$io->info('Creating directory ' . dirname($controllerPath), true);
mkdir(dirname($controllerPath), 0755, true); // un-normalized, runs before validation
}
Proof of concept
$ php vendor/flightphp/runway/runway make:controller '../../../../tmp/CONTROLLER_TRAVERSAL_TEST/pwn'
Creating directory .../app/controllers/../../../../tmp/CONTROLLER_TRAVERSAL_TEST
Nette\InvalidArgumentException: Value '../../../../tmp/CONTROLLER_TRAVERSAL_TEST/pwnController' is not valid class name.
$ ls /home/user/tmp/CONTROLLER_TRAVERSAL_TEST
(directory exists — created before the exception was thrown)
Impact
- Arbitrary directory creation outside the project root, executable by any local actor that can run the Flight CLI (developer machine, shared CI build agent, compromised dev container).
- Primes log-file planting for chained LFI exploitation (e.g. creating a directory where an attacker can later drop a
.phpfile to be included via a distinct template-include weakness). - On Windows, the
\separator opens additional traversal surface.
Patch (fixed in 3.18.1, commit b8dd23a)
The controller name is now normalized with basename() and validated against ^[A-Za-z_][A-Za-z0-9_]*$ before any mkdir side effect runs.
Credit
Discovered by @Rootingg.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | flightphp/core | all versions | 3.18.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for flightphp/core. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update flightphp/core to 3.18.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3xjv-pmf2-gf2q is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-3xjv-pmf2-gf2q is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-3xjv-pmf2-gf2q. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-3xjv-pmf2-gf2q in your dependencies?
O3 detects GHSA-3xjv-pmf2-gf2q across Packagist dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.