Read the docs

flextype

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

flextype records in CISA KEV

No flextype vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-61974 CVE-2026-91751 · GHSA-63h9-h8w7-v6fr

Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API

Priority HIGH 67

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00539 Published 2026-09-15 No fix listed CWE-22
TI-2026-54247 CVE-2026-77939 · GHSA-j8rr-2wmh-q2h8

Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Priority MEDIUM 64

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0061 Published 2026-08-28 No fix listed CWE-1336
TI-2026-60385 CVE-2026-89145 · GHSA-gqrp-6638-7vpg

Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Priority LOW 12

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies().

CVSS 4.0LOW 2.4 Local High privileges User interaction EPSS 0.00179 Published 2026-09-11 No fix listed CWE-79
Open these records in search →