Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: flextype Clear all filters
TI-2026-61974 CVE-2026-91751 · GHSA-63h9-h8w7-v6fr

Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API

Priority HIGH 67

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00539 Published 2026-09-15 No fix listed CWE-22
TI-2026-60385 CVE-2026-89145 · GHSA-gqrp-6638-7vpg

Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Priority LOW 12

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies().

CVSS 4.0LOW 2.4 Local High privileges User interaction EPSS 0.00179 Published 2026-09-11 No fix listed CWE-79
TI-2026-54247 CVE-2026-77939 · GHSA-j8rr-2wmh-q2h8

Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Priority MEDIUM 64

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0061 Published 2026-08-28 No fix listed CWE-1336