CVE-2026-77939

Name of the Vulnerable Software and Affected Versions Flextype CMS versions prior to 1.0.0-dev

Description An expression language injection exists that allows authenticated attackers with a valid API token to read arbitrary files. This occurs when unsanitized user input is passed to the Symfony ExpressionLanguage engine via the 'POST /api/v1/query' endpoint. Attackers can utilize exposed application objects, specifically filesystem() and serializers(), within the evaluation scope to access server files. This can lead to conditional remote code execution if a PHP file is successfully placed on the disk through a separate vector.

Recommendations Update Flextype CMS to a version later than 1.0.0-dev. Restrict access to the 'POST /api/v1/query' endpoint to minimize the risk of exploitation.