CVE-2026-89145: Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flextype CMSto a version that resolves this vulnerability.Fixed in 1.0.0-alpha.3 - Compensating control
Ensure attackers cannot write to the Flextype CMS plugins directory (restrict filesystem write permissions to trusted users/processes only) to prevent creation of plugin names containing HTML characters.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 are exposed if an attacker can write to the plugins directory and a user visits a dependency error page after plugin dependency validation fails.
What access does an attacker need to exploit it?
The attacker needs write access to the plugins directory so they can create a plugin whose directory name contains HTML characters. Exploitation also requires user interaction with the rendered dependency error page.
Are default installations affected?
The available information does not establish whether the default configuration permits write access to the plugins directory or whether dependency validation failures occur by default. Exposure depends on those conditions being present.
How can I determine whether an installation may already be affected?
Check whether the instance runs a version from 0.9.9 through 1.0.0-alpha.3, whether untrusted users or processes can write to the plugins directory, and whether plugin directory names contain HTML characters. Also review whether dependency validation error pages have been displayed to users.