Executive brief
Flextype is a flat-file content management system used to manage entries and content. A vulnerability in the Entries REST API allows authenticated users with valid API tokens to read, create, or overwrite arbitrary files on the server by bypassing directory validation. This can lead to complete compromise of the application and underlying server through unauthorized file manipulation.
Technical details
The vulnerability is a path traversal flaw in the Entries REST API endpoints that fails to properly validate the id and new_id parameters. Attackers with API token access can use directory traversal sequences (e.g., "../") in API requests to escape the intended entries directory and access arbitrary files and directories on the filesystem. The vulnerable component is the Entries.php file that processes these API parameters. Exploitation requires a valid API token but no additional authentication or user interaction. An attacker can read sensitive files, create new files outside the entries directory, or overwrite existing files, leading to potential remote code execution or data breach. The vulnerability affects Flextype through version 1.0.0-alpha.3; patches are expected in newer releases.
Affected products
- Flextype Flextype through 1.0.0-alpha.3
Timeline
- 2026-09-15: disclosed