Flextype CMS CVE-2026-77939

Exploitation requires possession of a valid Flextype CMS API token (PR:L per CVSS 4.0 vector), restricting the immediate attacker pool to authenticated users or those who have compromised a token. The target instance must have the REST API enabled and the POST /api/v1/query endpoint reachable over the network. The Symfony ExpressionLanguage component must be in scope with filesystem() and serializers() objects registered - this is the default application configuration per the description. Escalation to RCE further requires a secondary file-write vector (e.g., an upload endpoint, a writable temp directory, or a separate vulnerability) to place a PHP file on disk prior to expression invocation; without this, impact is limited to arbitrary file read. The API token requirement and need for a secondary write primitive are the primary limiting factors for defenders assessing risk.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) correctly captures the primary confirmed impact - high confidentiality loss - while the PR:L metric accurately reflects that a valid API token is required, meaningfully narrowing the exploitable population compared to unauthenticated flaws. The publicly available POC raises practical risk above what the base score alone suggests, as exploitation requires minimal effort once a token is obtained. However, no KEV listing exists, and Flextype is a niche product, making widespread scanning-style exploitation unlikely. The conditional RCE path is a material escalation concern but requires an independent file-write primitive, so integrity impact in the base score is appropriately absent. The most realistic near-term threat is targeted credential harvesting (reading .env or config files) by compromised or malicious API token holders. EPSS data was not provided; given the auth requirement and product rarity, real-world exploitation probability is assessed as moderate in targeted scenarios rather than broad.

An attacker who possesses a valid Flextype API token - obtained through credential theft, brute force, or social engineering - submits a POST request to /api/v1/query containing a crafted Symfony expression such as filesystem().read('/var/www/html/.env') to extract database credentials, secret keys, or application configuration. A publicly available proof-of-concept demonstrates this file-read path. If the attacker can additionally write a PHP file to a server-accessible path (e.g., via a file upload feature or world-writable temp directory), they invoke it through the expression engine to achieve remote code execution.