High severity · published Sep 15, 2026
CVE-2026-91751
Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API
8.3
CVSS
0.5%
EPSS
No
On KEV
Description
Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directory and manipulate arbitrary files and directories on the filesystem.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
flextype · flextype
through 1.0.0-alpha.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91751
github.com
https://github.com/flextype/flextype
github.com
https://github.com/flextype/flextype/blob/v1.0.0-alpha.3/src/flextype/core/Entries/Entries.php#L856-L906
github.com
https://github.com/flextype/flextype/issues/596
www.vulncheck.com
https://www.vulncheck.com/advisories/flextype-cms-through-1.0.0-alpha.3-path-traversal-via-entries-rest-api
More from flextype
6.5
CVE-2026-77939
Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint
5.9
CVE-2026-88897
Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String
4.2
CVE-2026-89145
Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory