CVE-2026-91751

Flextype CMS through version 1.0.0-alpha.3 fails to validate the id and new_id parameters in its Entries REST API, allowing path traversal. An attacker holding a valid API token can send requests containing traversal sequences that escape the project's entries directory and read, create, or overwrite arbitrary files and directories elsewhere on the filesystem. Depending on which files are targeted, this can lead to exposure of sensitive data, corruption of application or configuration files, or full site compromise, reflected in a CVSS 4.0 base score of 7.2 (high) with high integrity and availability impact. All Flextype deployments up to and including 1.0.0-alpha.3 that expose the Entries REST API to token holders are affected. No public proof-of-concept exists and no exploitation has been observed in the wild.

What to do: No fixed release is identified in the data (1.0.0-alpha.3 is the affected and latest noted version), so operators should mitigate rather than simply upgrade: disable or tightly restrict the Entries REST API, issue API tokens only to trusted users and rotate any that may have leaked, and run the CMS under an account/container with minimal filesystem permissions so traversal cannot reach sensitive paths. Audit for unexpected files or modifications outside the entries directory and review API logs for traversal sequences (e.g., ../, URL-encoded variants) in id and new_id parameters.