https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 20:23:52 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-77939 <p>Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.</p> <p>Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-77939 https://vulnerability.circl.lu/vuln/gcve-1988-2026-0171 <p><strong>Affected:</strong> Flextype</p> <p>Description</p> <p>Flextype CMS contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes(). The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content containing PHP code to be written outside the intended entries directory.</p> <p>The /api/v1/query endpoint subsequently permits an attacker-controlled path to reach Shortcodes::registerShortcodes(), where the supplied path is passed to an include_once operation relative to FLEXTYPE_ROOT_DIR.</p> <p>An attacker can therefore first use the path traversal condition to place a PHP-containing file at a predictable location beneath the application root and then invoke registerShortcodes() with the path to that file. PHP interprets the included file as executable PHP regardless of the .md extension, resulting in execution of attacker-controlled code in the context of the Flextype PHP process. Impact</p> <p>A remote attacker with the required API access can execute arbitrary PHP code with the privileges of the Flextype application process. This may result in complete compromise of the affected Flextype installation, including unauthorized access to application data, modification or deletion of content, disclosure of sensitive configuration or credentials accessible to the application, installation of persistent malicious code, and further compromise of resources accessible from the application server.</p> <p>The demonst…</p> <p><strong>Affected:</strong> Flextype</p> <p>Description</p> <p>Flextype CMS contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes(). The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content containing PHP code to be written outside the intended entries directory.</p> <p>The /api/v1/query endpoint subsequently permits an attacker-controlled path to reach Shortcodes::registerShortcodes(), where the supplied path is passed to an include_once operation relative to FLEXTYPE_ROOT_DIR.</p> <p>An attacker can therefore first use the path traversal condition to place a PHP-containing file at a predictable location beneath the application root and then invoke registerShortcodes() with the path to that file. PHP interprets the included file as executable PHP regardless of the .md extension, resulting in execution of attacker-controlled code in the context of the Flextype PHP process. Impact</p> <p>A remote attacker with the required API access can execute arbitrary PHP code with the privileges of the Flextype application process. This may result in complete compromise of the affected Flextype installation, including unauthorized access to application data, modification or deletion of content, disclosure of sensitive configuration or credentials accessible to the application, installation of persistent malicious code, and further compromise of resources accessible from the application server.</p> <p>The demonst…</p> https://vulnerability.circl.lu/vuln/gcve-1988-2026-0171 https://vulnerability.circl.lu/vuln/ghsa-j8rr-2wmh-q2h8 <p>Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.</p> <p>Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.</p> https://vulnerability.circl.lu/vuln/ghsa-j8rr-2wmh-q2h8