Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H N N 7.1 .0061 47.4 —
AFFECTED Product Versions Fixed flextype unspecified —
TIMELINE Aug 21 Reserved by VulnCheck Aug 28 Published (CNA: VulnCheck) Aug 29 EXPLOIT PUBLISHED — CVE-2026-77939 (flextype). Public exploit reference added.
Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. Attackers can leverage exposed application objects including filesystem() and serializers() within the evaluation scope to read arbitrary server files and achieve conditional remote code execution if a PHP file can be placed on disk through a secondary vector.
| Date | Event | Detail |
|---|---|---|
| August 21, 2026 | Reserved | Reserved by VulnCheck |
| August 28, 2026 | Published | Published (CNA: VulnCheck) |
| August 29, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-77939 (flextype). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| flextype | flextype | — | — | — |
Authoritative record: CVE-2026-77939 at cve.org
Vendors: flextype
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-77939 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
