CVE-2026-89145: Flextype CMS XSS Vulnerability

CVE-2026-89145 Overview

CVE-2026-89145 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Flextype CMS versions 0.9.9 through 1.0.0-alpha.3. The flaw exists in the getValidPluginsDependencies() function within Plugins.php, which fails to HTML-escape plugin directory names when rendering the dependency error page. An attacker with write access to the plugins directory can create a plugin whose folder name contains HTML or JavaScript payloads. When dependency validation fails, the unescaped name is rendered in the browser of any user viewing the error page, executing attacker-controlled scripts in that user's session.

Critical Impact
Authenticated attackers with plugin directory write access can execute arbitrary JavaScript in the browsers of other Flextype users, enabling session theft or administrative actions on their behalf.

Affected Products

Flextype CMS 0.9.9
Flextype CMS 1.0.0-alpha.1 through 1.0.0-alpha.3
Flextype Plugins.php core component (dependency validation rendering path)

Discovery Timeline

2026-09-11 - CVE-2026-89145 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89145

Vulnerability Analysis

The vulnerability resides in Flextype's plugin dependency validation logic. When Flextype loads plugins, getValidPluginsDependencies() checks each plugin's declared dependencies. If a dependency is missing or invalid, the function renders an error page that includes the offending plugin's directory name as part of the diagnostic message. Because the directory name is interpolated into HTML output without escaping, any HTML metacharacters in the name are parsed by the browser rather than displayed as text.

The stored nature of the vulnerability comes from the plugin directory itself acting as persistent storage. Once a malicious folder is created on disk, the payload triggers every time dependency validation fails, affecting any authenticated user who reaches the error page. See the Flextype Code Reference and the VulnCheck Advisory for the source-level details.

Root Cause

The root cause is missing output encoding. The rendering path concatenates raw filesystem-derived strings into an HTML response without invoking an escaping function such as htmlspecialchars(). Filesystem-sourced input is treated as trusted despite being attacker-controllable in deployments where multiple users hold write access to the plugins directory.

Attack Vector

Exploitation requires local or authenticated access sufficient to create a directory under Flextype's plugins/ path. The attacker names the directory using HTML tags containing JavaScript, then either introduces a broken dependency or waits for validation to fail. When an administrator or other user loads the plugin management interface and dependency validation returns an error, the injected script executes in that user's browser context. User interaction is required, and privileges to write to the plugins directory are a prerequisite, which limits practical exposure.

No verified proof-of-concept code has been published. See the Flextype Issue #597 tracking discussion for technical details.

Detection Methods for CVE-2026-89145

Indicators of Compromise

Plugin subdirectories under plugins/ whose names contain characters such as <, >, ", ', or the substrings script, onerror, or onload.
HTTP responses from Flextype admin endpoints containing dependency error messages with unescaped angle brackets in plugin name fields.
Unexpected outbound requests originating from administrator browser sessions immediately after accessing the plugin management page.

Detection Strategies

Perform recursive directory listings of the Flextype plugins/ folder and flag entries whose names do not match a strict allowlist such as ^[A-Za-z0-9_-]+$.
Inspect web server access logs for admin sessions loading plugin management pages followed by anomalous requests to external hosts.
Add file integrity monitoring on the plugins/ directory to alert on new subdirectory creation events.

Monitoring Recommendations

Audit which operating system and application accounts have write access to the Flextype plugins directory and log all changes.
Monitor administrator authentication events and correlate session tokens with any unusual API activity after visiting plugin pages.
Enable Content Security Policy (CSP) violation reporting on the Flextype admin interface to surface unexpected inline script execution.

How to Mitigate CVE-2026-89145

Immediate Actions Required

Restrict filesystem write access to the Flextype plugins/ directory to trusted administrators only.
Enumerate existing plugin directory names and rename or remove any containing HTML metacharacters.
Require administrators to log out of active sessions before inspecting the plugin management page on potentially affected instances.
Deploy a strict Content Security Policy that disallows inline scripts on Flextype admin routes.

Patch Information

No fixed release is referenced in the advisory data at the time of publication. Track the Flextype GitHub Repository and Flextype Issue #597 for the upstream fix, which should apply HTML escaping to plugin directory names before rendering them in the dependency error page.

Workarounds

Enforce a plugin directory naming policy at the operating system level, rejecting any names outside an alphanumeric allowlist.
Place a reverse proxy or web application firewall rule in front of Flextype admin endpoints to strip responses containing unescaped script tags in plugin name contexts.
Limit administrative access to the Flextype backend to a trusted IP range until a patched release is available.

bash

# Example: audit plugin directory names for HTML metacharacters
find /var/www/flextype/plugins -mindepth 1 -maxdepth 1 -type d \
  | grep -E '[<>"'\''&]|script|onerror|onload' \
  && echo "Suspicious plugin directory names detected"