Posted by Ron E on Sep 03Description Flextype CMS v1.0.0-alpha.3 contains a path traversal vulnerability in the Entries copy functionality. An authenticated remote attacker can supply directory traversal sequences within both the source id and destination new_id parameters submitted to /api/v1/entries/copy. Flextype constructs entry directory paths by directly concatenating the supplied entry identifier with the configured entries directory without sufficiently...