CVE-2026-77939: Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint
Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid Flextype API token and network access to the POST /api/v1/query endpoint. Unauthenticated attackers are not described as able to exploit it.
What is the practical impact if exploitation succeeds?
An authenticated attacker can read arbitrary files from the server through expression-language injection. Remote code execution is conditional: it requires a separate way to place a PHP file on disk.
Is remote code execution possible through this vulnerability alone?
The available information describes direct arbitrary file read through the query endpoint. Code execution additionally depends on a secondary file-placement vector that allows the attacker to write a PHP file to disk.