Flextype v1.0.0-alpha.3 has been identified with a critical stored expression injection vulnerability that allows for Remote Code Execution (RCE). The flaw exists due to the interaction between the CMS's entry expression processing and the exposure of a mutable application registry object. Attackers can leverage this to modify the runtime configuration, specifically enabling the PHP entry directive which is usually restricted, by using a malicious expression within an entry field.
Once the PHP directive is enabled, an attacker can embed an @php directive within the same stored field. When the entry is retrieved, Flextype processes the content through PHP's eval() function, resulting in the execution of arbitrary code within the application's security context. Testing has confirmed that this execution is persistent, occurring every time the malicious entry is accessed via the API or frontend, potentially leading to a complete compromise of the server.