EUVD-2026-75896
GHSA-gqrp-6638-7vpg
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local filesystem write access required (AV:L/PR:H); victim must view error page (UI:R); XSS crosses into victim browser scope (S:C); low C/I, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.
AnalysisAI
Stored cross-site scripting in Flextype CMS 0.9.9 through 1.0.0-alpha.3 allows an attacker with write access to the server-side plugins directory to inject arbitrary scripts into administrators' browsers. The vulnerable sink is the dependency error page rendered by getValidPluginsDependencies() in Plugins.php, which reflects plugin directory names without HTML-encoding. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker must have write access to the Flextype plugins directory on the server filesystem (high-privilege local access, AV:L/PR:H); (2) a plugin with a malicious directory name must be present such that its dependencies fail validation - either the attacker creates a new plugin or modifies an existing directory name; (3) an authenticated Flextype user (typically an administrator) must browse to a page that invokes getValidPluginsDependencies() and triggers the error rendering path (UI:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.4 is accurate and appropriately conservative. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the issue is open on GitHub (https://github.com/flextype/flextype/issues/597) without a confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitra
Flextype CMS REST API routes through version 1.0.0-alpha.3 transmit API authentication token pairs as URL query string p
Path traversal in Flextype CMS through 1.0.0-alpha.3 allows API token holders to escape the designated entries directory
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today