Flextype Flextype vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Flextype Flextype: 4 record(s), with affected versions and fixes.
CVE-2026-91751
High · 8.3
CWE-22 Sep 14, 2026
Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API
Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directory and manipulate arbitrary files and directories on the filesystem.
CVE-2026-89145
Medium · 4.2
CWE-79 Sep 10, 2026
Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.
CVE-2026-88897
Medium · 5.9
CWE-598 Sep 10, 2026
Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.
CVE-2026-77939
Medium · 6.5
CWE-94 Aug 28, 2026
Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint
Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.