EUVD-2026-78233

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and newid parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries director...

CVE-2026-91751

Flextype CMS versions through 1.0.0-alpha.3 are affected by a path traversal vulnerability in the Entries REST API , caused by improper validation of the id and new_id parameters. Any holder of a valid API token can use traversal sequences in API requests to escape the project's entries directory...

PT-2026-91772

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directo...