Flextype CMS v1.0.0-alpha.3: Eight Disclosed Vulnerabilities Enable Auth Bypass, File Read, SSRF, and PHP Remote Code Execution

Eight Full Disclosure postings describe vulnerabilities in Flextype CMS v1.0.0-alpha.3: a NULL access_token authentication bypass, path traversals in the Entries API enabling arbitrary directory copy, file disclosure, and PHP remote code execution, and stored…

Eight separate postings on the Full Disclosure mailing list, dated September 3, 2026, describe vulnerabilities in Flextype CMS v1.0.0-alpha.3. Four of the posts credit Ron E as discloser (path traversal in entries copy, stored filesystem shortcode, registerShortcodes() RCE, and the stored fetch shortcode reports); the other four name no author. The flaws span several components: (1) Authentication bypass - endpoints declaring access_token as required only validate key presence, and isset($data['access_token']) treats a NULL value as absent, so requests supplying a NULL access_token bypass authentication. (2) Entries API path traversal - /api/v1/entries/copy accepts traversal sequences in both the source id and destination new_id parameters, with paths built by direct concatenation, enabling arbitrary directory copies and file disclosure; separately, /api/v1/entries accepts traversal in entry identifiers, allowing PHP-containing content to be written outside the entries directory, which Shortcodes::registerShortcodes() then includes and executes, yielding PHP remote code execution. (3) Stored injection - entry fields are parsed via parsers()->expressions()->parse() when global expression processing is enabled; the expression environment exposes the mutable registry() object, which combined with the PHP entry directive yields stored PHP remote code execution, and the ExpressionsDirective also permits arbitrary file read. When global shortcode processing is enabled, the filesystem shortcode returns the contents of any supplied path without directory restrictions (arbitrary file read) and the fetch shortcode forwards attacker-controlled URLs to the server-side fetch() helper (stored SSRF). (4) Direct SSRF - the /api/v1/query endpoint exposes fetch() to authenticated users without sufficient destination restrictions. Most issues require an authenticated user with privileges to create or modify entries. The reports agree on the affected version and do not contradict one another on technical facts; no CVE identifiers, vendor patches, or exploitation evidence are mentioned in any report.

• All eight disclosures concern Flextype CMS v1.0.0-alpha.3; no other versions are named.
• The issues were posted to the Full Disclosure mailing list with a disclosure date of September 3, 2026; Ron E is credited in the entries-copy path traversal, filesystem shortcode, registerShortcodes() RCE, and stored fetch shortcode posts,…
• No CVE identifiers, vendor patches, or evidence of exploitation are cited in any of the eight reports.
• Authentication bypass: required-parameter validation only checks that the access_token key exists, and isset($data['access_token']) treats a NULL value as absent, allowing requests with a NULL access_token to bypass authentication on…
• Stored expression injection: entry fields are parsed via parsers()->expressions()->parse() during entry retrieval when global expression processing is enabled; the expression environment exposes the mutable registry() object, which…
• The ExpressionsDirective flaw also enables arbitrary file read when stored, unsanitized expression syntax in entry fields is processed.
• SSRF in /api/v1/query: authenticated attackers can pass arbitrary URLs to the exposed fetch() function; insufficient destination restrictions allow outbound requests to attacker-controlled or internal hosts.
• Stored fetch shortcode: when global shortcode processing is enabled, saved entry fields are passed to the server-side fetch() helper without restrictions, enabling stored server-side request forgery.