Flatpress is a lightweight, file-based blogging platform with a small but persistent vulnerability footprint concentrated in its single product line. The platform's exposure recurs through a suite of web-application weaknesses including cross-site scripting, cross-site request forgery, path traversal, cleartext cookie storage, and external control of file paths—vulnerability classes typical of platforms that handle user input, session management, and file operations. A meaningful share of the vendor's disclosures reach serious severity, and the vulnerabilities frequently acquire public exploit code, making timely patching important for deployments. Defenders running Flatpress instances should prioritize updates for this product and monitor for exploitation attempts given the availability of public tooling; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Flatpress over time
Signals from CVEs in this vendor scope (36 CVEs).
36 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-4606CRITICAL PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3. | Dec 18, 2022 | 9.8 | 52 | NO | NO |
CVE-2023-0947CRITICAL Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. | Feb 22, 2023 | 9.8 | 42 | NO | YES |
CVE-2022-4748CRITICAL A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.fi | Dec 27, 2022 | 9.8 | 31 | NO | NO |
CVE-2021-41432MEDIUM A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content. | Jun 23, 2022 | 5.4 | 29 | NO | YES |
CVE-2022-40048HIGH Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function. | Sep 29, 2022 | 7.2 | 27 | NO | NO |
CVE-2020-35241MEDIUM FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the | Dec 30, 2020 | 4.8 | 26 | NO | YES |
CVE-2022-40047MEDIUM Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php. | Oct 11, 2022 | 5.4 | 25 | NO | YES |
CVE-2024-41290HIGH FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component. | Oct 2, 2024 | 8.1 | 23 | NO | NO |
CVE-2024-4023HIGH A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3. When a user uploads a file with a `.xsig` extension and directly accesses this file | Mar 20, 2025 | 8.1 | 22 | NO | NO |
CVE-2023-1105HIGH External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3. | Mar 1, 2023 | 8.1 | 22 | NO | NO |
Signals from CVEs in this vendor scope (36 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Flatpress.
Media articles that mention a CVE ID that affects a product developed by Flatpress — matched by CVE ID, not by vendor name.