Medium severity · published Aug 28, 2026
CVE-2026-77939
Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
flextype · flextype
through 1.0.0-dev; through aea4ead8c449ea5517ed53b6dcbd28b0a528ad9d · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77939
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77939
github.com
https://github.com/flextype/flextype/issues/595
www.vulncheck.com
https://www.vulncheck.com/advisories/flextype-cms-dev-rce-via-post-api-v1-query-endpoint
More from flextype
8.3
CVE-2026-91751
Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API
5.9
CVE-2026-88897
Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String
4.2
CVE-2026-89145
Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory