CVE-2026-77939

Flextype CMS through v1.0.0-dev fails to sanitize user-supplied input passed to the Symfony ExpressionLanguage engine at the POST /api/v1/query endpoint, allowing an expression language injection. An authenticated attacker holding a valid API token can craft expressions that invoke exposed application objects such as filesystem() and serializers() to read arbitrary files on the server. If the attacker can additionally place a PHP file on disk through a secondary vector, the injection can escalate to conditional remote code execution. Any Flextype instance whose API is reachable and whose API tokens are in circulation is affected. There is no known public proof-of-concept, no CISA KEV entry, and a low EPSS score of 0.4%, indicating exploitation is not currently observed.

What to do: Audit which accounts hold valid Flextype API tokens and revoke or rotate any that are unnecessary, since a valid token is required for exploitation. Restrict network access to the /api/v1/query endpoint, sanitize or validate input passed into the expression engine, and consider disabling or limiting the filesystem() and serializers() objects in the evaluation scope. Monitor for a patched release (all versions through 1.0.0-dev are affected) and upgrade as soon as one is published, and check access logs for unusual POST /api/v1/query calls.