CVE-2026-77939: Flextype CMS Expression Language RCE Flaw

CVE-2026-77939 Overview

CVE-2026-77939 is an expression language injection vulnerability in Flextype CMS through version 1.0.0-dev. The flaw resides in the POST /api/v1/query endpoint, which passes unsanitized user input to the Symfony ExpressionLanguage engine. Authenticated attackers with a valid API token can invoke exposed application objects such as filesystem() and serializers() inside the evaluation scope. This access enables arbitrary file reads on the server. Attackers can escalate to remote code execution when a PHP file can be placed on disk through a secondary vector. The issue is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated attackers can read arbitrary files from the Flextype host and achieve conditional remote code execution by chaining a file-write primitive with the injected expression evaluation.

Affected Products

Flextype CMS through 1.0.0-dev
Deployments exposing the POST /api/v1/query endpoint
Instances issuing API tokens to untrusted or low-privilege users

Discovery Timeline

2026-08-28 - CVE-2026-77939 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-77939

Vulnerability Analysis

Flextype exposes a query API that accepts client-supplied expressions and evaluates them through the Symfony ExpressionLanguage component. The evaluation context contains application-level helper objects, including filesystem() for file operations and serializers() for data transformation. Because Flextype does not restrict the callable surface or sanitize the incoming expression, an authenticated caller can invoke these helpers directly during evaluation.

A malicious expression can read files outside the CMS content directory, including configuration files, environment variables, and PHP source. If the attacker can drop a PHP payload onto the filesystem through another feature such as media upload or content authoring, the expression evaluator can be used to include or execute that file, resulting in remote code execution on the web server.

Root Cause

The root cause is unsafe use of a dynamic expression evaluator on untrusted input. Symfony ExpressionLanguage is a general-purpose evaluator, and Flextype registers powerful helper functions into its scope without an allowlist. There is no sandbox, no function filtering, and no validation of the input structure before evaluation.

Attack Vector

An attacker with a valid API token sends an HTTP POST request to /api/v1/query containing an expression that references the registered helpers. The server evaluates the expression server-side and returns the result. The vector is remote and authenticated, and requires no user interaction.

See the VulnCheck Advisory: Flextype RCE and GitHub Issue #595 for the technical write-up and proof-of-concept expressions.

Detection Methods for CVE-2026-77939

Indicators of Compromise

HTTP POST requests to /api/v1/query whose bodies contain the strings filesystem, serializers, read(, or file path fragments such as /etc/passwd or .env.
Unexpected 200 responses from /api/v1/query returning large payloads or file-like content to non-administrative API tokens.
Web server or PHP process reading files outside the Flextype content directory shortly after an API query request.
New or modified .php files under upload or media directories followed by /api/v1/query calls that reference their paths.

Detection Strategies

Enable request body logging on the API gateway or reverse proxy in front of Flextype and alert on expression syntax patterns targeting /api/v1/query.
Correlate API token identifiers with sensitive file access on the host filesystem to surface abuse of low-privilege tokens.
Baseline normal query expressions per API token and flag deviations that reference filesystem or serializer helpers.

Monitoring Recommendations

Forward web server, PHP-FPM, and Flextype application logs to a centralized SIEM or data lake for retention and correlation.
Monitor for anomalous outbound connections from the PHP worker process, which can indicate post-exploitation activity.
Track file integrity of the Flextype webroot and configuration directories to detect payload drops.

How to Mitigate CVE-2026-77939

Immediate Actions Required

Restrict network access to /api/v1/query to trusted management networks until a patched build is deployed.
Rotate all Flextype API tokens and revoke tokens issued to users who do not require query access.
Audit the Flextype webroot and upload directories for unexpected .php files or recently modified content.
Review web server access logs for prior POST requests to /api/v1/query referencing filesystem helpers.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Flextype 1.0.0-dev is a development branch, and users should track the upstream project via GitHub Issue #595 for remediation status. Avoid running development branches on internet-exposed infrastructure.

Workarounds

Disable or remove the /api/v1/query route in the Flextype routing configuration if the endpoint is not required.
Place the Flextype instance behind an authenticating reverse proxy and block POST requests to /api/v1/query at the proxy layer.
Enforce least-privilege on API tokens and prohibit token issuance to untrusted users.
Run the PHP worker under a restricted OS user with read-only access to configuration files and no write access to the webroot.

bash

# Example nginx rule to block the vulnerable endpoint
location = /api/v1/query {
    return 403;
}