CVE-2026-89145
MediumCVSS 4.2Summary
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.
Risk Assessment
A stored XSS vulnerability allows execution of malicious JavaScript in the victim's browser context, potentially leading to session theft or admin account takeover. However, it requires write access to the plugins directory.
Recommendation
Update Flextype CMS to a version newer than 1.0.0-alpha.3 that properly escapes plugin directory names. Restrict write access to the plugins directory to trusted administrators only.
Other vulnerabilities in Flextype CMS
See all- CVE-2026-88897Medium
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.
- CVE-2026-77939Medium
Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.
Original NVD description (English source)
Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts in users' browsers when dependency validation fails.