CVE-2026-77939

Received Received - Intake

Expression Language Injection in Flextype CMS

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-77939

EUVD

EUVD-2026-67837

Affected Vendors & Products

Vendor	Product	Version / Range
flextype	cms	1.0.0-dev

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

Flextype CMS through v1.0.0-dev has an expression language injection flaw. Authenticated attackers with a valid API token can exploit this by sending unsanitized input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. This allows reading arbitrary files on the server by leveraging exposed objects like filesystem() and serializers(). If a PHP file is placed on disk through another method, attackers may achieve conditional remote code execution.

Detection Guidance

To detect this vulnerability, monitor for suspicious POST requests to /api/v1/query with unsanitized input. Check server logs for unauthorized file reads or ExpressionLanguage engine usage. Use tools like grep to search for patterns like 'ExpressionLanguage' or 'filesystem()' in logs.

Impact Analysis

This vulnerability allows attackers to read sensitive files on the server, potentially exposing confidential data like configuration files, user credentials, or application source code. If combined with another exploit to place a PHP file, attackers could execute arbitrary code, leading to full system compromise.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face legal penalties, reputational damage, and loss of compliance certifications due to potential data breaches.

Mitigation Strategies

Immediately update Flextype CMS to a patched version. Disable the /api/v1/query endpoint if unused. Restrict API token access to least privilege. Implement input validation and sanitization for all API inputs. Monitor for unauthorized file access attempts.

Hi! I’m here to help you understand CVE-2026-77939. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70