{"id":"CVE-2026-89145","title":"Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies()","summary":"Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin…","severity":"medium","cvss":4.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"flextype","product":"flextype","affected":["flextype >= 0.9.9 <= 1.0.0-alpha.3"],"published":"2026-09-11","updated":"2026-09-11","sourceUpdated":"2026-09-11T15:17:08.727","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89145","references":[{"url":"https://github.com/flextype/flextype","label":"disclosure@vulncheck.com"},{"url":"https://github.com/flextype/flextype/blob/aea4ead8c449ea5517ed53b6dcbd28b0a528ad9d/src/flextype/core/Plugins.php#L345","label":"disclosure@vulncheck.com"},{"url":"https://github.com/flextype/flextype/issues/597","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/flextype-cms-0.9.9-through-1.0.0-alpha.3-stored-xss-via-plugin-directory","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-11T14:24:34.386841Z"},"epss":0.00128,"epssPercentile":0.02823,"ingestedAt":"2026-09-11T16:45:47.859Z","slug":"CVE-2026-89145","body":"## Overview\n\nFlextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":23.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}