Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck

CVE-2026-77939Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Medium 6.5

In plain English

A medium-severity code injection in flextype from flextype. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 50.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.

Affected products (as reported)

Vendor	Product	Versions
flextype	flextype	0 – through 1.0.0-dev0 – through aea4ead8c449ea5517ed53b6dcbd28b0a528ad9d

Weakness: CWE-94, CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Researcher Disclosure technical-description, exploit, issue-tracking
https://www.vulncheck.com/advisories/flextype-cms-dev-rce-via-post-api-v1-query-endpoint third-party-advisory