Description

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T20:19:56.397Z",
  "pubdate": "2026-08-28T20:19:56.397Z",
  "executiveSummary": "Flextype CMS, up to and including version v1.0.0-dev, is susceptible to an expression language injection vulnerability located within its API query processing mechanism.\nThe vulnerability arises from the improper sanitization of user-supplied input before it is passed to the Symfony ExpressionLanguage engine, allowing authenticated users with a valid API token to execute arbitrary expressions.\nBy manipulating the expression evaluation context, an attacker can access sensitive system objects, including filesystem and serializer components, to perform unauthorized file system operations, such as arbitrary file disclosure.\nThe impact of this vulnerability is significant, as it facilitates unauthorized access to sensitive data and provides a potential vector for further exploitation, including conditional remote code execution if combined with other vulnerabilities such as arbitrary file uploads.\nThe attack requires valid authentication via an API token, limiting the scope to registered or privileged users, but poses a severe risk to the integrity and confidentiality of the host environment.",
  "technicalDetails": "The vulnerability resides within the POST /api/v1/query endpoint of Flextype CMS. The application architecture leverages the Symfony ExpressionLanguage component to dynamically process queries sent by authenticated users. The core issue is an injection flaw where the application fails to adequately restrict or sanitize the expression input before evaluation.\nWhen a request is submitted to the /api/v1/query endpoint, the provided payload is evaluated by the server-side ExpressionLanguage engine. Because the evaluation context is insufficiently hardened, the engine exposes sensitive internal objects to the expression parser. Specifically, the filesystem() and serializers() service objects remain accessible within the execution scope.\nAn authenticated attacker can craft a malicious POST request containing a payload designed to leverage these exposed objects. For instance, by calling filesystem()->read('/path/to/sensitive/file'), the attacker can force the application to read and return the contents of arbitrary files from the server's filesystem, effectively bypassing standard application-level access controls.\nThe attack flow follows these steps: first, the attacker authenticates using a valid API token to gain access to the API endpoint. Second, the attacker constructs a crafted query string containing PHP-like syntax compatible with the Symfony ExpressionLanguage. Third, the crafted expression invokes the filesystem() object to perform read operations outside the intended document root. Finally, the application returns the contents of the requested file in the API response, leading to direct data exfiltration.\nFurthermore, the vulnerability serves as a primitive for more advanced exploitation. If an attacker identifies a secondary vector to place a malicious PHP script on the disk—such as an arbitrary file upload vulnerability—the expression language injection can be used to reference and include that file, potentially leading to remote code execution (RCE).\nThis vulnerability persists in all versions of Flextype CMS up to v1.0.0-dev. The reliance on the Symfony ExpressionLanguage engine without strict sandboxing or a whitelist of allowed functions creates a persistent security weakness that allows for deep interaction with the underlying application environment."
}