---
id: CVE-2026-91751
title: >-
  Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id
  parameters in the Entries REST API, allowing API token holders to read,
  create, or overwrite files outside the entries directory
summary: >-
  Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id
  parameters in the Entries REST API, allowing API token holders to read,
  create, or overwrite files outside the entries directory. Attackers can use
  traversal seq…
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H'
cwe:
  - CWE-22
vendor: flextype
product: flextype
affected:
  - flextype <= 1.0.0-alpha.3
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:47:01.197'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91751'
references:
  - url: 'https://github.com/flextype/flextype'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/flextype/flextype/blob/v1.0.0-alpha.3/src/flextype/core/Entries/Entries.php#L856-L906
    label: disclosure@vulncheck.com
  - url: 'https://github.com/flextype/flextype/issues/596'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/flextype-cms-through-1.0.0-alpha.3-path-traversal-via-entries-rest-api
    label: disclosure@vulncheck.com
  - url: 'https://github.com/flextype/flextype/issues/596'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00539
epssPercentile: 0.42985
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-15T19:05:57.635722Z'
ingestedAt: '2026-09-15T01:18:29.937Z'
---

## Overview

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directory and manipulate arbitrary files and directories on the filesystem.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.