Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitylow

Flextype v1.0.0-alpha.3 Stored Fetch Shortcode Allows Server-Side Request Forgery

Full Disclosure ()1
Read at seclists.org
Part of a story covered by 8 sourcesFlextype CMS v1.0.0-alpha.3: Eight Disclosed Vulnerabilities Enable Auth Bypass, File Read, SSRF, and PHP Remote Code ExecutionMerged summary & timeline
AI summary · glm-5.3-flashSummaries by Vani AI

Flextype CMS v1.0.0-alpha.3's stored fetch shortcode enables server-side request forgery via attacker-controlled entry fields passed to fetch().

Flextype CMS v1.0.0-alpha.3 automatically processes attacker-controlled entry fields through its shortcode parser when global shortcode processing is enabled. The built-in fetch shortcode passes attacker-controlled resources to the server-side fetch() helper without sufficient destination restrictions. This enables stored server-side request forgery initiated from saved entry content. The issue was disclosed on the Full Disclosure mailing list on September 3, 2026.

Key facts
  • Stored entry fields are parsed as shortcodes when global shortcode processing is enabled
  • The fetch shortcode forwards attacker-controlled URLs to the server-side fetch() helper without restrictions
  • No CVE identifier or patch information is referenced in the disclosure
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
cmsflextypephpshortcodesssrf
Vendors
Flextype
Products
Flextype CMS
Organizations
Full Disclosure

From the original article

Posted by Ron E on Sep 03 Description Flextype CMS v1. 0. 0-alpha.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.