Math1As

An issue was discovered that allows Server-Side Request Forgery (SSRF) via a loopback address to the `validate localhost` function in `url blocker.rb`.

A Remote Code Execution issue allows remote attackers to execute code and obtain a webshell from the back-end. The attacker must be authenticated and enter PHP code in the `datasource` editor or `event` editor.

The issue allows for Unrestricted File Upload, enabling an attacker to bypass safety checks by uploading a file named 'xxx.php[space]'. This could lead to the execution of arbitrary code.