EUVD-2026-78233
GHSA-63h9-h8w7-v6fr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network REST API access (AV:N), trivial traversal mechanics (AC:L), valid API token required (PR:L); arbitrary file read justifies C:H not C:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directory and manipulate arbitrary files and directories on the filesystem.
AnalysisAI
Path traversal in Flextype CMS through 1.0.0-alpha.3 allows API token holders to escape the designated entries directory and read, create, or overwrite arbitrary files accessible to the web server process. The Entries REST API accepts unsanitized id and new_id parameters and passes them directly into filesystem operations, permitting traversal sequences such as '../../' to resolve paths outside the intended content tree. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid Flextype Entries REST API token - without one, the API endpoint rejects requests and traversal is not reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H) correctly captures network reachability, low attack complexity, and the authentication prerequisite of a valid API token (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been identified at time of analysis; operators should monitor the GitHub issue tracker at https://github.com/flextype/flextype/issues/596 for an official fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitra
Flextype CMS REST API routes through version 1.0.0-alpha.3 transmit API authentication token pairs as URL query string p
Stored cross-site scripting in Flextype CMS 0.9.9 through 1.0.0-alpha.3 allows an attacker with write access to the serv
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today