CVE-2026-42552: falha de alta gravidade em flightphp core
Flight: Sensitive information disclosure via default error handler in flightphp/core
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.3%
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
flightphp · coreCVEs relacionadas — flightphp core
No mesmo produto, das mais perigosas para as menos.
CVE-2026-42550HIGHFlight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / deleteEPSS 0.5%CVE-2014-125127HIGHDenial of Service (DoS) vulnerability in mikecao/flightEPSS 0.5%CVE-2026-42548HIGHFlight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()EPSS 0.4%CVE-2026-42551HIGHFlight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/coreEPSS 0.4%CVE-2026-42549MEDIUMFlight: Path traversal in `make:controller` CLI creates arbitrary directories outside project rootEPSS 0.2%