Alienkeric

A `forge.tls` client accepts a `compression method` in the ServerHello that it did not offer. When the client handles ServerHelloDone, the `tls.createConnectionState()` function rejects the unsupported compression algorithm by throwing an Error that propagates from `connection.process()`. A malicious server or an on-path attacker can alter the unauthenticated ServerHello compression byte before the server Finished message to terminate a Node.js process if the application does not catch the exception. Affected client paths include direct `forge.tls` use, `forge.tls.wrapSocket`, and `forge.http`. This issue does not impact confidentiality or integrity, and `forge.tls` servers are not affected.

An SQL injection issue allows users with an admin-token to read the `history.db` database. This occurs when unescaped values are provided for the `op` and `type=3` query parameters. By sending crafted UNION SELECT payloads to the 'searchHistory' and 'getHistoryItems' endpoints, an attacker can exfiltrate titles, paths, and content of deleted documents.

ExifReader is susceptible to a denial-of-service issue when parsing specially crafted HEIC or AVIF ISO-BMFF files. The problem occurs in the `getItems()` function within `src/image-header-iso-bmff-iloc.js`, where the parser trusts the `itemCount` and `extentCount` values from the `iloc` box. When the `offsetSize`, `lengthSize`, `baseOffsetSize`, and `indexSize` variables are set to zero, the buffer offset does not advance, but the parser continues to allocate extent objects in a nested loop. This can lead to the allocation of up to 4.3 billion objects, causing massive heap growth or exhausting system memory, which terminates the Node.js process. This affects web, desktop, or mobile applications that parse untrusted images.

An authenticated SQL injection exists in the 'fullTextSearchBlock' endpoint via the `method` query parameter. This allows attackers to use UNION SELECT statements to read the entire blocks table, which bypasses publish-access controls and exposes sensitive attributes and all document content.

An attacker can craft a PDF with a cyclic tree structure that triggers an infinite loop. This occurs when a writing code path utilizes the `TreeObject.insert child()` function in `pypdf/generic/ data structures.py`, causing it to follow `/Next` links indefinitely.

Improper session invalidation occurs because JSON Web Tokens (JWT) access tokens are issued without a `jti` (JWT ID) claim, preventing server-side revocation. While refresh tokens can be managed, access tokens remain valid for their entire duration (defaulting to 1 hour) even after a user logs out, changes their password, receives a new token, or has their account disabled. This allows an attacker with a stolen access token to maintain full API access until the token expires naturally.

An issue exists where the XSS blueprint validator `Security::detectXss()` processes raw page content before Twig processing occurs. If Twig content processing is enabled via `twig content.process enabled: true`, a user with page-write API permissions can bypass the validator using Twig's string concatenation operator (~) to dynamically create event handlers, dangerous tags, or protocols. Because the validator only sees the Twig expression and not the final rendered output, arbitrary JavaScript can be executed in the browsers of visitors when the content is rendered via `{{ page.content|raw }}`.

A file upload extension bypass exists in the API media controller. The function `validateFileExtension()` only inspects the final file extension using `pathinfo($filename, PATHINFO EXTENSION)`, allowing a user with `api.media.write` permission to upload files with double extensions, such as shell.php.jpg, to bypass the blocklist of dangerous extensions. This can lead to remote code execution if the web server executes the uploaded file as PHP.

An arbitrary file write issue exists in the Form plugin. The `process.save.filename` parameter is validated against path traversal before Twig processing but is not re-validated after rendering. This allows attackers to submit form data with path traversal sequences that, when processed through Twig templates, enable the creation of arbitrary files, such as PHP webshells, within the web root or other sensitive directories.

A decompression bomb issue exists in the `ZipArchiver::extract()` function. The function does not impose limits on the number of files, nesting depth, or the total uncompressed size of archives. An attacker can provide a specially crafted ZIP archive that expands to consume all available disk space, resulting in a denial of service by exhausting storage resources.

Insufficient sanitization of SVG files uploaded via the 'POST /api/v1/media' endpoint allows an authenticated attacker with `api.media.write` permission to upload a file containing arbitrary JavaScript. The `HandlesMediaUploads::processUploadedFile()` function only validates the file extension and fails to call `Security::sanitizeSVG()`. Because the file is stored unmodified and served as `image/svg+xml`, the embedded script executes in the session context of an administrator who opens the file, potentially leading to cookie theft and session hijacking.