Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read
Flextype CMS v1.0.0-alpha.3's stored filesystem shortcode allows arbitrary file reads because paths are not restricted to an approved directory.
Flextype CMS v1.0.0-alpha.3 automatically processes stored entry fields through its shortcode parser when global shortcode processing is enabled. The built-in filesystem shortcode accepts a file path and returns the contents of the specified file without restricting the path to an approved application directory. This allows arbitrary file reads from the server. Ron E disclosed the issue on the Full Disclosure mailing list on September 3, 2026.
- Stored entry fields are automatically processed by the shortcode parser when global processing is enabled
- The filesystem shortcode returns the contents of any supplied path without directory restrictions
- No CVE identifier or patch status is mentioned in the disclosure
- Vendors
- Flextype
- Products
- Flextype CMS
- Organizations
- Full Disclosure
From the original article
Posted by Ron E on Sep 03 Description Flextype CMS v1. 0. 0-alpha.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.