Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read

Flextype CMS v1.0.0-alpha.3's stored filesystem shortcode allows arbitrary file reads because paths are not restricted to an approved directory.

Flextype CMS v1.0.0-alpha.3 automatically processes stored entry fields through its shortcode parser when global shortcode processing is enabled. The built-in filesystem shortcode accepts a file path and returns the contents of the specified file without restricting the path to an approved application directory. This allows arbitrary file reads from the server. Ron E disclosed the issue on the Full Disclosure mailing list on September 3, 2026.

• Stored entry fields are automatically processed by the shortcode parser when global processing is enabled
• The filesystem shortcode returns the contents of any supplied path without directory restrictions
• No CVE identifier or patch status is mentioned in the disclosure