Flextype v1.0.0-alpha.3 Stored Expression Injection Enables PHP Remote Code Execution
Flextype CMS v1.0.0-alpha.3 stored expression injection exposes the mutable registry object, enabling stored PHP remote code execution.
Flextype CMS v1.0.0-alpha.3 evaluates attacker-controlled entry fields as expressions during entry retrieval when global expression processing is enabled. The expression environment exposes the application's mutable registry() object, which attackers can manipulate. Combined with the PHP entry directive, this enables stored PHP remote code execution from crafted entry content. The flaw was disclosed on the Full Disclosure mailing list on September 3, 2026.
- Entry fields are automatically evaluated as expressions during entry retrieval
- The expression environment exposes the mutable registry() object to attackers
- Manipulating the registry combined with the PHP entry directive yields stored code execution
- Vendors
- Flextype
- Products
- Flextype CMS
- Organizations
- Full Disclosure
From the original article
Posted by Ron E on Sep 03 Description Flextype CMS v1. 0. 0-alpha.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.