CVE-2026-91751: Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API
Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and newid parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directory and manipulate arbitrary files and directories on the filesystem.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid API token. The vulnerable interface is the Entries REST API, so exposure depends on whether that API is reachable by the attacker and whether they can obtain or use a token.
What access can exploitation provide?
A token holder can use traversal sequences in the id or new_id parameters to escape the project entries directory. This can allow reading, creating, or overwriting files and directories elsewhere on the filesystem.
Which releases are identified as affected?
Flextype CMS through version 1.0.0-alpha.3 is identified as affected. No fixed version is provided in the available data.