CVE-2026-91751CWE-22path-traversal

CVE-2026-91751

High · published September 15, 2026

CVSS v3.1
8.3
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directory and manipulate arbitrary files and directories on the filesystem.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
7.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00539 · 44.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-15T05:16Z
References (5)
https://github.com/flextype/flextype · [email protected]https://github.com/flextype/flextype/blob/v1.0.0-alpha.3/src/flextype/core/Entries/Entries.php#L856-L906 · [email protected]https://github.com/flextype/flextype/issues/596 · [email protected]https://www.vulncheck.com/advisories/flextype-cms-through-1.0.0-alpha.3-path-traversal-via-entries-rest-api · [email protected]https://github.com/flextype/flextype/issues/596 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 00:35Z
    Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API
    cvelistv5