Dong2209

An issue in the way theme translation files are loaded allows an authenticated Administrator to read JSON files located outside of the active theme directory, which could lead to the exposure of server configuration secrets.

Embed cards in the editor allow staff users, including those with Contributor roles, to bypass protections against stored cross-site scripting (XSS). This occurs when scripts are stored in post content and subsequently execute when another staff user opens the post in the editor, which could lead to the compromise of that user's admin session.

A path traversal issue exists in the theme translation file loading process. This allows authenticated administrators to read JSON files located outside the active theme directory by manipulating the locale setting, which can lead to the exposure of server configuration secrets.

An authorization flaw allows an authenticated site member to read excerpts of posts they are not permitted to access, specifically affecting gated content.

Symlink confinement checks in the static site generator stop at the mount root. This allows a theme or vendored module located in `themes/` to contain a symlink at a mount root (e.g., `themes/mytheme/assets` pointing to `/some/dir/outside`). Files behind such symlinks can be read during a site build using functions such as `resources.Get()` and `resources.Match()`, and may be published to the `public/` directory via static mounts. This bypasses the requirement that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected as their zip files cannot contain symlinks.

Node.js tools including `css.PostCSS`, `css.TailwindCSS`, and `js.Babel` are executed under a permission model intended to restrict file system reads to the project directory and configured mounts. However, the model only validates the lexical path and follows symbolic links pointing outside the allowed set, failing to detect symlinks that escape the sandbox. An attacker capable of contributing content to a project can commit a symbolic link pointing to a sensitive file, such as `/etc/passwd`, combined with a PostCSS plugin to read it. This allows any file readable by the build process to be disclosed and potentially embedded in the published site. This issue affects builds using the default security configuration and does not impact projects that do not use Node.js tools.

A stored cross-site scripting issue exists because the syntax highlighter fails to escape the `lineAnchors` option before passing it to Chroma. This causes the value to be written verbatim into the `id` and `href` attributes of the generated line-number markup. If a crafted `lineAnchors` value is provided via a Markdown code fence attribute or the `highlight` template function, unescaped HTML is rendered on the page, enabling arbitrary JavaScript execution in the browsers of visitors. This specifically impacts sites that build and publish Markdown content from untrusted contributors.