Flextype v1.0.0-alpha.3 Path Traversal in Entry Copy Allows Arbitrary Directory Copy and File Disclosure
Flextype CMS v1.0.0-alpha.3 entries copy endpoint accepts path traversal in source and destination parameters, enabling arbitrary directory copies and file disclosure.
Flextype CMS v1.0.0-alpha.3 constructs entry directory paths in the copy functionality by directly concatenating supplied entry identifiers with the configured entries directory. The /api/v1/entries/copy endpoint accepts directory traversal sequences in both the source id and destination new_id parameters. An authenticated remote attacker can thereby copy arbitrary directories and disclose files outside the intended entries directory. Ron E disclosed the issue on the Full Disclosure mailing list on September 3, 2026.
- Traversal sequences are accepted in both the source id and destination new_id parameters
- Paths are built by direct concatenation with the entries directory without sufficient validation
- Exploitation requires authentication; no patch or observed exploitation is mentioned
- Vendors
- Flextype
- Products
- Flextype CMS
- Organizations
- Full Disclosure
From the original article
Posted by Ron E on Sep 03 Description Flextype CMS v1. 0. 0-alpha.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.