Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token… (CVE-2026-77939)

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability (CWE-94) that permits authenticated users with valid API tokens to inject expressions into the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. This injection allows reading arbitrary server files by leveraging exposed application objects such as filesystem() and serializers(). Additionally, if an attacker can place a PHP file on the server through a secondary vector, they may achieve conditional remote code execution. The CVSS 3.1 score is 6.5 (High) with network attack vector, low attack complexity, and requiring privileges but no user interaction.

The vulnerability allows authenticated attackers to read arbitrary files on the server, potentially exposing sensitive data. It also opens the possibility of conditional remote code execution if an attacker can upload a PHP file via another vulnerability or vector. This elevates the risk to confidentiality and potentially integrity of the affected system. No known exploits in the wild have been reported yet.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict API token usage to trusted users only and monitor for suspicious activity related to the POST /api/v1/query endpoint. Avoid exposing this endpoint to untrusted networks.