PT-2026-38274 · Flight · Flight

Published 2026-05-06 · Updated 2026-05-13 · CVE-2026-42552

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flight versions prior to 3.18.1

Description The default error handler Engine:: error() writes the full exception message, exception code, and stack trace, including absolute filesystem paths, directly into the HTTP 500 response without debug gating. This leads to the disclosure of internal paths, secrets interpolated into exception messages, and the full module structure. Such information can be used to facilitate other attacks, such as Local File Inclusion (LFI) or path traversal.

Recommendations Update to version 3.18.1. As a temporary workaround, restrict access to the Engine:: error() function or implement custom error handling to prevent verbose output in production environments.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2026-42552

GHSA-QRCH-52M5-VV85

Affected Products

Flight

References · 8

• 🔥 https://github.com/flightphp/core/security/advisories/GHSA-qrch-52m5-vv85 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42552 · Security Note
• https://osv.dev/vulnerability/GHSA-qrch-52m5-vv85 · Vendor Advisory
• https://github.com/flightphp/core/releases/tag/v3.18.1 · Note
• https://github.com/flightphp/core/commit/b8dd23aaa828cb289fa3c84e75b2a3717cab50b0 · Note
• https://github.com/flightphp/core · Note
• https://twitter.com/CVEnew/status/2054709242557538696 · Twitter Post
• https://t.me/CVEtracker/53698 · Telegram Post