Stored XSS in Flextype CMS Plugin Directory Names

Executive Summary

CVE-2026-89145 is a stored Cross-Site Scripting (XSS) vulnerability in Flextype CMS versions 0.9.9 through 1.0.0-alpha.3. It occurs when plugin directory names are not properly HTML-escaped in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.

Useful 0 Not Useful 0

Detection Guidance

Check for plugins with unusual names containing HTML or JavaScript characters in the Flextype plugins directory. Review error logs for dependency validation failures that may render plugin names unsafely. Inspect the output of getValidPluginsDependencies() for unescaped HTML in error pages.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into web pages viewed by users. If you use a vulnerable Flextype CMS version, an attacker could trick you into visiting a page where their injected script runs in your browser, potentially stealing session cookies, credentials, or other sensitive data. Exploitation requires the attacker to have write access to the plugins directory on the server.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protecting health information. If exploited, it may result in data breaches, unauthorized data access, or disclosure of sensitive information, potentially leading to regulatory penalties and loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Flextype to a patched version if available. Restrict write access to the plugins directory to trusted users only. Rename any existing plugin directories with suspicious names. Implement input validation to block HTML characters in plugin names. Apply htmlspecialchars() to plugin names in error output.

Useful 0 Not Useful 0