Flextype
Monthly
Path traversal in Flextype CMS through 1.0.0-alpha.3 allows API token holders to escape the designated entries directory and read, create, or overwrite arbitrary files accessible to the web server process. The Entries REST API accepts unsanitized id and new_id parameters and passes them directly into filesystem operations, permitting traversal sequences such as '../../' to resolve paths outside the intended content tree. No public exploit code has been identified and no CISA KEV listing exists, but the vulnerability is mechanically straightforward for any actor already possessing a valid API token.
Flextype CMS REST API routes through version 1.0.0-alpha.3 transmit API authentication token pairs as URL query string parameters, causing them to be persistently recorded in web server access logs, proxy logs, CDN logs, and monitoring systems. Any party with read access to those log stores - including system administrators, shared-hosting neighbors, compromised monitoring infrastructure, or log-aggregation services - can extract valid tokens and use them for full API access. No public exploit identified at time of analysis, but exploitation requires only standard log-reading tools and the vulnerability is trivially exploitable once log access is obtained.
Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.
Stored cross-site scripting in Flextype CMS 0.9.9 through 1.0.0-alpha.3 allows an attacker with write access to the server-side plugins directory to inject arbitrary scripts into administrators' browsers. The vulnerable sink is the dependency error page rendered by getValidPluginsDependencies() in Plugins.php, which reflects plugin directory names without HTML-encoding. Exploitation requires the attacker to first plant a malicious plugin directory name and then wait for an authenticated user to trigger a dependency validation failure; no public exploit or active exploitation has been identified at time of analysis.
Path traversal in Flextype CMS through 1.0.0-alpha.3 allows API token holders to escape the designated entries directory and read, create, or overwrite arbitrary files accessible to the web server process. The Entries REST API accepts unsanitized id and new_id parameters and passes them directly into filesystem operations, permitting traversal sequences such as '../../' to resolve paths outside the intended content tree. No public exploit code has been identified and no CISA KEV listing exists, but the vulnerability is mechanically straightforward for any actor already possessing a valid API token.
Flextype CMS REST API routes through version 1.0.0-alpha.3 transmit API authentication token pairs as URL query string parameters, causing them to be persistently recorded in web server access logs, proxy logs, CDN logs, and monitoring systems. Any party with read access to those log stores - including system administrators, shared-hosting neighbors, compromised monitoring infrastructure, or log-aggregation services - can extract valid tokens and use them for full API access. No public exploit identified at time of analysis, but exploitation requires only standard log-reading tools and the vulnerability is trivially exploitable once log access is obtained.
Expression language injection in Flextype CMS through v1.0.0-dev enables authenticated API token holders to read arbitrary server-side files by passing unsanitized input to the Symfony ExpressionLanguage engine via POST /api/v1/query. The evaluation scope exposes application objects including filesystem() and serializers(), making sensitive file disclosure (credentials, configuration files, secrets) straightforward for any token-bearing attacker. Escalation to remote code execution is conditionally possible if a secondary vector exists to place a PHP file on disk; a publicly available proof-of-concept exists, and the vulnerability is not yet in CISA KEV.
Stored cross-site scripting in Flextype CMS 0.9.9 through 1.0.0-alpha.3 allows an attacker with write access to the server-side plugins directory to inject arbitrary scripts into administrators' browsers. The vulnerable sink is the dependency error page rendered by getValidPluginsDependencies() in Plugins.php, which reflects plugin directory names without HTML-encoding. Exploitation requires the attacker to first plant a malicious plugin directory name and then wait for an authenticated user to trigger a dependency validation failure; no public exploit or active exploitation has been identified at time of analysis.