Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read
Flextype CMS v1.0.0-alpha.3's stored filesystem shortcode allows arbitrary file reads because paths are not restricted to an approved directory.
Flextype CMS v1.0.0-alpha.3 automatically processes stored entry fields through its shortcode parser when global shortcode processing is enabled. The built-in filesystem shortcode accepts a file path and returns the contents of the specified file without restricting the path to an approved application directory. This allows arbitrary file reads from the server. Ron E disclosed the issue on the Full Disclosure mailing list on September 3, 2026.
26