This vulnerability arises from an expression language injection flaw in Flextype CMS, allowing authenticated attackers with a valid API token to inject unsanitized input into the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint. The injection can exploit exposed objects such as filesystem() and serializers() within the evaluation scope, giving the attacker the ability to read arbitrary files on the server. If the attacker can place a PHP file on disk through a secondary vector, they may obtain conditional remote code execution. The flaw is classified under CWE-1336 (Expression - poor validation of user input) and CWE-94 (Improper Handling of Dynamic Input), and carries a CVSS score of 7.1.

The affected product is Flextype CMS, all releases up to and including the 1.0.0-dev version. No further subversions are currently documented as impacted.

With a valid API token, an attacker can immediately craft a malicious expression and invoke the POST /api/v1/query endpoint to read any file accessible to the PHP process. The lack of a KEV listing and absence of an EPSS score do not diminish the realistic risk, especially in environments where the API is exposed and tokens are not tightly controlled. The CVSS score of 7.1 indicates a high impact if exploited, and the ability to read files can serve as a foothold for more destructive actions such as remote code execution.