Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion
Flextype CMS v1.0.0-alpha.3 allows PHP remote code execution via path traversal in the Entries API combined with shortcode file inclusion.
Flextype CMS v1.0.0-alpha.3 exposes a remote code execution path through the interaction of the Entries API and Shortcodes::registerShortcodes(). The /api/v1/entries endpoint accepts attacker-controlled entry identifiers containing path traversal sequences, allowing PHP-containing content to be written outside the intended entries directory. A subsequent attacker-controlled path can then be included and executed as PHP. Ron E posted the disclosure to the Full Disclosure mailing list on September 3, 2026.
- /api/v1/entries accepts traversal sequences in entry identifiers, writing PHP content outside the entries directory
- Shortcodes::registerShortcodes() then includes the attacker-controlled path, executing injected PHP code
- No CVE identifier, patch, or observed exploitation is mentioned in the disclosure
- Vendors
- Flextype
- Products
- Flextype CMS
- Organizations
- Full Disclosure
From the original article
Posted by Ron E on Sep 03 Description Flextype CMS contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes(). The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content containing PHP code to be written outside the intended entries directory.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.