Crypto-Cat

An SQL injection issue exists in GraphQL eager-loading, where arguments on eager-loadable nodes that are absent from the public schema are copied into `EagerLoadPlan` criteria without proper cleansing. Unauthenticated attackers can provide a parenthesized select argument to inject SQL expressions, allowing them to read arbitrary database content, such as session tokens and password hashes.

An issue exists in file-upload handling where the destination path is not validated before writing to disk. This allows authenticated attackers to perform path traversal, which is a method of accessing files and directories that are restricted from the user, by uploading crafted files to locations outside the intended storage directory to achieve remote code execution on the server.

An arbitrary file read issue exists in the handling of attributes within outgoing email HTML. Attackers capable of supplying outgoing email content can set an attribute value that references a local file path, allowing them to expose sensitive files from the server.

A failure in the database connection is incorrectly interpreted as the software not being installed. This allows anonymous installer actions, such as `install/validate-site`, to be accessed on a production site if PHP is available but the MySQL endpoint is not. The process accepts a site name, serializes it via `Site::getName()`, and expands `${NAME}` expressions using `App::env()`. An unauthenticated attacker with a valid guest session cookie and CSRF token can provide a predictable variable name, such as `CRAFT SECURITY KEY`, to disclose sensitive information including process environment variables, `$ SERVER` entries, PHP constants, database credentials, or API keys. This issue requires an independent database outage to be exploitable.

An issue exists where the software signs an authenticated user's attacker-controlled license-shun cookie using the same key and format used to validate signed redirect parameters. This occurs because the HMAC signature is not bound to its purpose, as the `cookieValidationKey` is derived from the same `securityKey` used for signed request parameters. An authenticated, non-administrator user can set the cookie via the license-shun endpoint and transplant the signed envelope into the redirect parameter. Upon a successful login, the system validates the signature and renders the authenticated bytes as an unsandboxed Twig template. Within this template, the `map` filter accepts a string callback, allowing the `system()` function to execute arbitrary operating-system commands as the web-server user. Exploitation requires an account using password authentication without active 2FA, the default request configuration, and the availability of the PHP `system()` function.

An attacker with a GitHub account can inject a JavaScript payload into a craftcms/cms issue title. The payload executes within the control panel session of a Craft admin when they use the CraftSupport widget Give feedback screen and enter a search term that retrieves the poisoned issue. This process requires no control panel account or elevated privileges from the attacker.

A stored cross-site scripting issue exists where a user with author-level control panel permissions can embed a malicious JavaScript payload within an entry title. The execution occurs when an administrator or a user with `saveEntries` permissions for the same Structure section performs a drag operation on another entry under the affected entry in the table view. This happens because the server escapes the title into `data-title`, which the browser decodes and jQuery reads via `.data('title')`, subsequently concatenating it into a new HTML string without proper attribute escaping. Successful exploitation requires the attacker to have at least an Author role and the victim to perform a specific drag action while possessing elevated session privileges.