Flextype v1.0.0-alpha.3 Path Traversal in Entry Copy Allows Arbitrary Directory Copy and File Disclosure

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-04 00:13 UTC
Importiert: 2026-09-04 01:57 UTC
Quelle-ID: full_disc
uid_hash: 5ac73bfb0c88072ac5617e859ea97d1846128d5bc18660cd209b48dc6cd2b332

Full Disclosure

Posted by Ron E on Sep 03 Description

Flextype CMS v1.0.0-alpha.3 contains a path traversal vulnerability in the

Entries copy functionality. An authenticated remote attacker can supply

directory traversal sequences within both the source id and destination

new_id parameters submitted to /api/v1/entries/copy.

Flextype constructs entry directory paths by directly concatenating the

supplied entry identifier with the configured entries directory without

sufficiently...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss