FlightPHP Core's default error handling routine logs full exception details, including absolute file paths and stack trace, directly to the HTTP 500 response without any debug gating. This unconditionally leaks internal file paths, secrets that may have been interpolated into exception messages, and the overall module structure to an attacker, providing useful information that could facilitate further attacks such as local file inclusion or path traversal.

The affected component is FlightPHP Core for all versions prior to 3.18.1. The vulnerability is present in any environment running those versions, regardless of deployment configuration.

The CVSS base score of 7.5 indicates a high severity. Without a specified EPSS, the exploitation probability is uncertain but the vulnerability is not yet listed in CISA KEV, meaning no known widespread public exploitation. An attacker can exploit this weakness by triggering an exception in the application on a publicly reachable endpoint; because the error handler emits the sensitive data unconditionally, the attack vector is direct application-level interaction. Once the sensitive information is exposed, an attacker can leverage it to craft more targeted exploitation campaigns, increasing the overall risk.