Marxabo Keldibekova

**Name of the Vulnerable Software and Affected Versions** Flextype CMS versions prior to 1.0.0-dev **Description** An expression language injection exists that allows authenticated attackers with a valid API token to read arbitrary files. This occurs when unsanitized user input is passed to the Symfony ExpressionLanguage engine via the 'POST /api/v1/query' endpoint. Attackers can utilize exposed application objects, specifically `filesystem()` and `serializers()`, within the evaluation scope to access server files. This can lead to conditional remote code execution if a PHP file is successfully placed on the disk through a separate vector. **Recommendations** Update Flextype CMS to a version later than 1.0.0-dev. Restrict access to the 'POST /api/v1/query' endpoint to minimize the risk of exploitation.