CVE-2026-91751 Details
Description
Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directory and manipulate arbitrary files and directories on the filesystem.
A path traversal vulnerability has been identified in Flextype CMS versions through 1.0.0-alpha.3. The issue arises in the Entries REST API, where the 'id' and 'new_id' parameters are not properly validated before being used in filesystem operations. This lack of validation allows API token holders to escape the designated entries directory and manipulate files and directories elsewhere on the filesystem. Exploitation can lead to unauthorized reading, creation, or overwriting of files, as well as potentially moving, copying, or deleting directories accessible to the web server process.
To address this vulnerability, it is recommended to implement proper validation and normalization of all user-controlled filesystem paths before executing any filesystem operations. The application should ensure that the resolved paths remain within the intended directory boundaries, preventing unauthorized access to other parts of the filesystem.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flextype/flextype/issues/596 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/flextype/flextype | [email protected] | Vendor |
| https://github.com/flextype/flextype/blob/v1.0.0-alpha.3/src/flextype/core/Entries/Entries.php#L856-L906 | [email protected] | Source CodeVendor |
| https://github.com/flextype/flextype/issues/596 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/flextype-cms-through-1.0.0-alpha.3-path-traversal-via-entries-rest-api | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flextype | <= 1.0.0-alpha.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |