CVE-2018-11686: FlexPaper Publish Service improper input validation enables RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS of 9.8 and high EPSS, with public exploit references available.

What it is

FlexPaper (later FlowPaper) 2.3.6 exposes a Publish Service whose setup.php and change_config.php scripts fail to properly validate input, allowing remote code execution. The flaw is remotely reachable without authentication or user interaction, so any internet-exposed instance is at serious risk.

Impact

An unauthenticated attacker can execute arbitrary code on the server hosting the Publish Service, gaining full control of confidentiality, integrity and availability of that host.

Attack surface

Reached over the network through the Publish Service endpoints setup.php and change_config.php; the CVSS vector shows no privileges required and no user interaction, so no authentication is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.525 probability, 98.9th percentile) and public references are tagged Exploit, indicating working exploit code is publicly available.

What to do

• Upgrade FlexPaper/FlowPaper past 2.3.6 to a fixed release per the vendor release notes
• If upgrade is not possible, remove or block external access to setup.php and change_config.php
• Restrict the Publish Service to trusted networks or place it behind an authenticated reverse proxy
• Run the service with least privilege and isolate it from sensitive internal systems
• Monitor vendor advisories for further guidance on the affected Publish Service component

Detection

• Review web server logs for requests to setup.php and change_config.php, especially POSTs from unexpected sources
• Alert on new or modified files and unexpected child processes spawned by the web server user
• Monitor outbound network connections from the FlexPaper host for signs of post-exploitation activity
• Baseline normal Publish Service traffic and flag anomalous request patterns to those endpoints

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.