Information Disclosure in Flight Micro-Framework by Flight

CVE-2026-42552

What is CVE-2026-42552?

The Flight micro-framework for PHP, prior to version 3.18.1, contains an information disclosure vulnerability. The default error handler Engine::_error() exposes sensitive internal details by outputting the complete exception message, including the exception code and stack trace, directly in the HTTP 500 response. This flaw can occur without proper debugging controls, potentially revealing internal filesystem paths and secrets within exception messages. Attackers can exploit this information to string together further attacks, such as Local File Inclusion (LFI) and path traversal, thereby compromising the security of production environments.

References