Msegoviag

An issue in the way theme translation files are loaded allows an authenticated Administrator to read JSON files located outside of the active theme directory, which could lead to the exposure of server configuration secrets.

An issue in the way the system loads theme translation files allows an authenticated Administrator to execute arbitrary code on the server by using a crafted theme.

A path traversal issue exists in the theme translation file loading process. This allows authenticated administrators to read JSON files located outside the active theme directory by manipulating the locale setting, which can lead to the exposure of server configuration secrets.

Authenticated administrators can achieve remote code execution by abusing the theme translation file loading process. This occurs when an attacker with administrator privileges uploads a specially crafted theme containing malicious translation files, allowing the execution of arbitrary code on the server.

There is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. However, the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link.

An authenticated malicious actor with Admin privileges could trigger a database error by adding a special character on the add or edit User forms. This error can be surfaced back to the actor on the UI and, on certain database engines, may include the entire user row, including the `pbkdf2:sha256` hashed password.