Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directory and manipulate arbitrary files and directories on the filesystem.

Flextype CMS versions through 1.0.0-alpha.3 contain a path traversal vulnerability in the Entries REST API. The vulnerability stems from improper validation of the 'id' and 'new_id' parameters. Authenticated API token holders can exploit traversal sequences to escape the designated entries directory. This allows attackers to read, create, or overwrite arbitrary files and directories on the filesystem. The affected code is located in the Entries.php core file. Exploitation requires possession of a valid API token, limiting but not eliminating risk. The vulnerability has been publicly disclosed with references to the affected source code on GitHub. A VulnCheck advisory has also been published detailing the issue.