CVE-2026-91751 in Flextype
Summary
by MITRE • 09/15/2026
Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directory and manipulate arbitrary files and directories on the filesystem.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Flextype CMS versions through 1.0.0-alpha.3 represents a critical path traversal flaw within its RESTful Application Programming Interface, specifically targeting the Entries endpoint. This security deficiency stems from an insufficient validation mechanism applied to the id and new_id parameters passed during API requests. In a properly secured content management system, these identifiers should be strictly bound to predefined directories or database records associated with user entries. However, due to the lack of rigorous sanitization, the application fails to ensure that file operations remain confined within the designated project entries directory. This oversight allows authenticated users possessing valid API tokens to manipulate filesystem paths using traversal sequences such as dot-dot-slash characters, effectively bypassing intended access controls and escaping the sandboxed environment meant for entry data storage.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes vulnerabilities where software does not properly neutralize special elements within a file name that can cause files or directories to be located outside of the intended directory. The operational impact of this vulnerability is severe because it grants attackers the ability to read sensitive configuration files, overwrite existing application code, or create new malicious scripts on the server hosting Flextype. By leveraging these traversal sequences in API requests, an attacker with a valid token can access arbitrary files and directories on the underlying operating system filesystem. This capability transforms what might seem like a simple content management error into a potential remote code execution vector if combined with other vulnerabilities such as file upload flaws or insecure deserialization issues present elsewhere in the application stack.
The exploitation of this vulnerability aligns closely with ATT&CK techniques related to File and Directory Discovery, where adversaries probe for sensitive information on compromised systems, and potentially T1059 Command and Scripting Interpreter if the attacker manages to write executable scripts into accessible directories that are later executed by the web server or system cron jobs. The presence of API token authentication does not mitigate this risk; rather, it provides a legitimate entry point for authenticated adversaries who may have obtained credentials through phishing, credential stuffing, or other means. Once inside, the ability to traverse outside the entries directory undermines the integrity and confidentiality guarantees provided by the CMS architecture, allowing for data exfiltration of sensitive project files or complete system compromise if critical configuration files are modified.
To mitigate this vulnerability, immediate action is required to update Flextype CMS to a version where these parameters are properly validated against path traversal patterns. Developers must implement strict input validation that rejects any id or new_id values containing directory traversal sequences such as ../ or ..\ regardless of encoding attempts. Additionally, the application should enforce canonicalization of file paths before performing any filesystem operations and verify that the resulting resolved path remains within the allowed base directory using absolute path comparison rather than simple string matching. Implementing a whitelist approach for acceptable characters in identifiers can further reduce the attack surface. For organizations still running affected versions, restricting API token privileges to only necessary endpoints and monitoring logs for unusual file access patterns involving traversal sequences are recommended interim defensive measures until an official patch is applied.