Ausi

An access control bypass exists in the file manager Edit-Multiple operation. Backend users with filemount restrictions can modify folders outside their assigned filemount if they possess the `protected` or `syncExclude` field permissions. By submitting external folder paths through the `IDS` parameter, an attacker can publish protected folders or exclude them from DBAFS synchronization, which may lead to files being exposed for public download.

A path traversal issue allows content editors to read image files from any location on the filesystem using the `{{image::}}` insert tag. This occurs because percent-encoded sequences, such as `..%2f`, can bypass the `Validator::isInsecurePath()` function before `rawurldecode()` is applied. Consequently, the frontend may resize and serve image files located outside the designated files directory.