CVE-2026-42552 is a CWE-209 vulnerability in FlightPHP core before version 3.18.1. The default error handler Engine::_error() outputs detailed exception data including messages, codes, stack traces, and absolute filesystem paths directly in HTTP 500 responses without restricting debug information. This leakage of internal paths and secrets can provide attackers with information useful for chaining further attacks such as local file inclusion and path traversal. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) and is resolved in FlightPHP version 3.18.1.

Exploitation of this vulnerability results in the disclosure of sensitive internal information such as filesystem paths, exception messages, and module structure in HTTP error responses. This information leakage can facilitate attackers in identifying and exploiting other vulnerabilities like local file inclusion and path traversal. There is no indication of direct code execution or data modification from this vulnerability alone.

Upgrade FlightPHP core to version 3.18.1 or later, where this vulnerability is fixed. Since the vulnerability is resolved in this official release, applying this update will prevent sensitive information leakage through error messages. No other specific mitigations are indicated.