CVE-2026-42552 Details

A vulnerability exists in Flight PHP versions prior to 3.18.1, where the default error handler, Engine::_error(), exposes sensitive information by writing the complete exception message, code, and stack trace, including absolute filesystem paths, directly into the HTTP 500 response. This lack of debug gating in production environments can leak internal paths, secrets embedded in exception messages, and the full module structure, potentially allowing attackers to exploit other vulnerabilities such as local file inclusion or path traversal. The issue is fixed in Flight PHP version 3.18.1.

Users can upgrade to Flight PHP version 3.18.1 or later, where this vulnerability has been fixed. In version 3.18.1, a new 'flight.debug' setting has been introduced to control the verbosity of error messages. In production environments, this setting should be kept false to prevent sensitive information from being disclosed. Developers can set 'flight.debug' to true in local environments to restore the full exception details.