CVE-2026-42552

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85
https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Flight es un micro-framework extensible para PHP. Antes de la versión 3.18.1, el gestor de errores predeterminado Engine::_error() escribe el mensaje completo de la excepción, el código de la excepción y el seguimiento de la pila (incluyendo rutas absolutas del sistema de archivos) directamente en la respuesta HTTP 500, sin control de depuración. Las implementaciones en producción filtran rutas internas, cualquier secreto interpolado en un mensaje de excepción y la estructura completa del módulo - proporcionando a los atacantes primitivas para encadenar otras debilidades (LFI, salto de ruta). Esta vulnerabilidad está corregida en la versión 3.18.1.

Information

Published : 2026-05-13 20:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-42552

Mitre link : CVE-2026-42552

CVE.ORG link : CVE-2026-42552

JSON object : View

Products Affected

No product.

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2026-42552", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42552", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T18:48:38.650639Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "flightphp", "product": "core", "versions": [{"status": "affected", "version": "< 3.18.1"}]}]}], "published": "2026-05-13T20:16:22.323", "references": [{"url": "https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85", "source": "security-advisories@github.com"}, {"url": "https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure \u2014 giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1."}, {"lang": "es", "value": "Flight es un micro-framework extensible para PHP. Antes de la versi\u00f3n 3.18.1, el gestor de errores predeterminado Engine::_error() escribe el mensaje completo de la excepci\u00f3n, el c\u00f3digo de la excepci\u00f3n y el seguimiento de la pila (incluyendo rutas absolutas del sistema de archivos) directamente en la respuesta HTTP 500, sin control de depuraci\u00f3n. Las implementaciones en producci\u00f3n filtran rutas internas, cualquier secreto interpolado en un mensaje de excepci\u00f3n y la estructura completa del m\u00f3dulo - proporcionando a los atacantes primitivas para encadenar otras debilidades (LFI, salto de ruta). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 3.18.1."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security-advisories@github.com"}