Executive brief
Flextype CMS is a flat-file content management system. An authenticated attacker with a valid API token can inject malicious code into the REST API query endpoint, allowing them to read arbitrary files from the server (such as configuration files and application secrets) and potentially execute remote code if a PHP file can be placed on disk through another means. This could lead to complete compromise of the CMS and underlying server.
Technical details
The vulnerability is a server-side expression language injection (CWE-94, CWE-1336) in the POST /api/v1/query endpoint. The vulnerable code at src/flextype/core/Endpoints/Query.php line 60 passes user-supplied input directly to the Symfony ExpressionLanguage engine without sanitization. The expression evaluation scope exposes dangerous application objects (filesystem(), serializers(), registry(), entries()) that can be leveraged to bypass the expression sandbox. An authenticated attacker with valid API credentials and network access can read arbitrary files via filesystem().file() calls, and conditionally achieve RCE through serializers() if a PHP file exists on disk. Direct function calls like system() are blocked, but the exposed objects effectively bypass the sandbox. The project is abandoned with no commits in 4+ years, making patch availability unlikely.
Affected products
- Flextype Flextype CMS through v1.0.0-dev
Timeline
- 2026-08-28: disclosed: Public disclosure via GitHub issue
- 2026-08-25: advisory: CVE-2026-77939 assigned by VulnCheck