Vulnerability-Lookup

CVE-2026-42552 (GCVE-0-2026-42552)

Vulnerability from cvelistv5 – Published: 2026-05-13 19:24 – Updated: 2026-05-15 18:49

Title

Flight: Sensitive information disclosure via default error handler in flightphp/core

Summary

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/flightphp/core/security/adviso…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
flightphp	core	Affected: < 3.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42552",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-15T18:48:38.650639Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T18:49:21.316Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "flightphp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure \u2014 giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:24:15.132Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85"
        }
      ],
      "source": {
        "advisory": "GHSA-qrch-52m5-vv85",
        "discovery": "UNKNOWN"
      },
      "title": "Flight: Sensitive information disclosure via default error handler in flightphp/core"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42552",
    "datePublished": "2026-05-13T19:24:15.132Z",
    "dateReserved": "2026-04-28T16:56:50.191Z",
    "dateUpdated": "2026-05-15T18:49:21.316Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42552",
      "date": "2026-05-26",
      "epss": "0.00015",
      "percentile": "0.03039"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-42552\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-13T20:16:22.323\",\"lastModified\":\"2026-05-15T19:16:58.507\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure \u2014 giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"}]}],\"references\":[{\"url\":\"https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42552\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-15T18:48:38.650639Z\"}}}], \"references\": [{\"url\": \"https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-15T18:47:53.468Z\"}}], \"cna\": {\"title\": \"Flight: Sensitive information disclosure via default error handler in flightphp/core\", \"source\": {\"advisory\": \"GHSA-qrch-52m5-vv85\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"flightphp\", \"product\": \"core\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.18.1\"}]}], \"references\": [{\"url\": \"https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85\", \"name\": \"https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure \\u2014 giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-209\", \"description\": \"CWE-209: Generation of Error Message Containing Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-13T19:24:15.132Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-42552\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-15T18:49:21.316Z\", \"dateReserved\": \"2026-04-28T16:56:50.191Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-13T19:24:15.132Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42552

Vulnerability from fkie_nvd - Published: 2026-05-13 20:16 - Updated: 2026-05-15 19:16

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure \u2014 giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1."
    }
  ],
  "id": "CVE-2026-42552",
  "lastModified": "2026-05-15T19:16:58.507",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-13T20:16:22.323",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-QRCH-52M5-VV85

Vulnerability from github – Published: 2026-05-06 21:39 – Updated: 2026-05-14 20:42

Summary

Flight vulnerable to sensitive information disclosure via default error handler

Details

Summary

The default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal).

Affected code

flight/Engine.php (≈ lines 678-704):

public function _error(Throwable $e): void
{
    ...
    $msg = sprintf(<<<'HTML'
        <h1>500 Internal Server Error</h1>
            <h3>%s (%s)</h3>
            <pre>%s</pre>
        HTML,
        $e->getMessage(),
        $e->getCode(),
        $e->getTraceAsString()
    );
    $this->response()->cache(0)->clearBody()->status(500)->write($msg)->send();
}

No flight.debug check, no environment gating.

Proof of concept

Any uncaught exception — including those auto-raised from handleError() — returns:

HTTP/1.1 500 Internal Server Error

<h1>500 Internal Server Error</h1>
  <h3>secret path /var/www/config/db.yml; token=LEAKED123 (0)</h3>
  <pre>#0 [internal function]: {closure}()
  #1 /home/user/app/vendor/flightphp/core/flight/core/Dispatcher.php(361)...
  #2 /home/user/app/vendor/flightphp/core/flight/Engine.php(...)
  ...
  </pre>

Reproduced against the live PoC app at /poc5/error.

Impact

Disclosure of absolute filesystem paths (primes weaponization of LFI / path-traversal vulnerabilities in the same application).
Disclosure of secrets (DB credentials, API tokens) when exceptions are constructed with interpolated configuration values.
Enumeration of installed vendor packages and internal application structure.

Patch (fixed in `3.18.1`, commit `b8dd23a`)

A new flight.debug setting (default false) gates the verbose output. In production the handler now emits only <h1>500 Internal Server Error</h1>. Developers can set flight.debug = true in local environments to restore the full trace output.

Credit

Discovered by @Rootingg.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "flightphp/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42552"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T21:39:07Z",
    "nvd_published_at": "2026-05-13T20:16:22Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe default error handler `Engine::_error()` writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure \u2014 giving attackers primitives for chaining other weaknesses (LFI, path traversal).\n\n### Affected code\n`flight/Engine.php` (\u2248 lines 678-704):\n\n```php\npublic function _error(Throwable $e): void\n{\n    ...\n    $msg = sprintf(\u003c\u003c\u003c\u0027HTML\u0027\n        \u003ch1\u003e500 Internal Server Error\u003c/h1\u003e\n            \u003ch3\u003e%s (%s)\u003c/h3\u003e\n            \u003cpre\u003e%s\u003c/pre\u003e\n        HTML,\n        $e-\u003egetMessage(),\n        $e-\u003egetCode(),\n        $e-\u003egetTraceAsString()\n    );\n    $this-\u003eresponse()-\u003ecache(0)-\u003eclearBody()-\u003estatus(500)-\u003ewrite($msg)-\u003esend();\n}\n```\n\nNo `flight.debug` check, no environment gating.\n\n### Proof of concept\nAny uncaught exception \u2014 including those auto-raised from `handleError()` \u2014 returns:\n\n```\nHTTP/1.1 500 Internal Server Error\n\n\u003ch1\u003e500 Internal Server Error\u003c/h1\u003e\n  \u003ch3\u003esecret path /var/www/config/db.yml; token=LEAKED123 (0)\u003c/h3\u003e\n  \u003cpre\u003e#0 [internal function]: {closure}()\n  #1 /home/user/app/vendor/flightphp/core/flight/core/Dispatcher.php(361)...\n  #2 /home/user/app/vendor/flightphp/core/flight/Engine.php(...)\n  ...\n  \u003c/pre\u003e\n```\n\nReproduced against the live PoC app at `/poc5/error`.\n\n### Impact\n- Disclosure of absolute filesystem paths (primes weaponization of LFI / path-traversal vulnerabilities in the same application).\n- Disclosure of secrets (DB credentials, API tokens) when exceptions are constructed with interpolated configuration values.\n- Enumeration of installed vendor packages and internal application structure.\n\n### Patch (fixed in `3.18.1`, commit `b8dd23a`)\nA new `flight.debug` setting (default `false`) gates the verbose output. In production the handler now emits only `\u003ch1\u003e500 Internal Server Error\u003c/h1\u003e`. Developers can set `flight.debug = true` in local environments to restore the full trace output.\n\n### Credit\nDiscovered by **@Rootingg**.",
  "id": "GHSA-qrch-52m5-vv85",
  "modified": "2026-05-14T20:42:12Z",
  "published": "2026-05-06T21:39:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42552"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flightphp/core/commit/b8dd23aaa828cb289fa3c84e75b2a3717cab50b0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/flightphp/core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flightphp/core/releases/tag/v3.18.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Flight vulnerable to sensitive information disclosure via default error handler"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-42552 (GCVE-0-2026-42552)

FKIE_CVE-2026-42552

GHSA-QRCH-52M5-VV85

Summary

Affected code

Proof of concept

Impact

Patch (fixed in 3.18.1, commit b8dd23a)

Credit

Tags

Sightings

Nomenclature

Patch (fixed in `3.18.1`, commit `b8dd23a`)