Path Traversal Vulnerability in Flextype CMS Entries REST API

Flextype CMS versions up to and including 1.0.0-alpha.3 contain a critical path traversal vulnerability (CVE-2026-91751) within the Entries REST API. The vulnerability stems from insufficient input validation of the 'id' and 'new_id' parameters when processing API requests. This flaw permits an attacker who possesses a valid API token to escape the intended project entries directory. By utilizing path traversal sequences, an attacker can navigate the filesystem to read sensitive configuration or application files, or create and overwrite files in arbitrary directories. Given the potential for arbitrary file creation and modification, successful exploitation could lead to full system compromise or remote code execution depending on the attacker's ability to inject payloads into executable paths or configuration files.

Impact

Successful exploitation of this vulnerability allows unauthorized access to the underlying filesystem of the server hosting Flextype CMS. This represents a significant risk to the integrity and confidentiality of the entire hosting environment, as it grants API token holders the ability to read sensitive data, corrupt application files, or potentially gain further control over the host via arbitrary file write operations.

Recommendation

Prioritized actions for detection and remediation teams:

• Upgrade Flextype CMS installations to a version beyond 1.0.0-alpha.3 immediately to address CVE-2026-91751.
• Audit existing API tokens to ensure only necessary users maintain access and revoke any suspected compromised tokens.
• Monitor web server access logs for anomalous requests containing path traversal patterns (e.g., ../) targeting the Entries REST API endpoints.
• Restrict access to the Entries REST API at the network or web server configuration level for untrusted network segments.