Capivara-Research

Insufficient sanitization of SVG file content during media upload allows authenticated users with the `media.create` permission to upload malicious SVG files containing script tags. When a user, including an administrator, opens the stored SVG file served inline from the application origin, the embedded JavaScript executes within the dashboard context. This can lead to session hijacking and administrative account takeover.

A path traversal issue exists in the core-upgrade backup handling. The `CoreUpgradeController` and `BackupService` (specifically the `deleteBackup()` function) concatenate the user-supplied `backup file` or `filename` variables directly onto the backup directory path without normalization or verification that the path remains within the intended directory. An authenticated user with `settings.edit` permissions can use traversal sequences to delete arbitrary files on the host filesystem or restore a ZIP archive from an unauthorized location, which can lead to remote code execution by writing arbitrary files into application directories.