Darren Carreras

An arbitrary file upload issue exists in the `extract zip data()` function. The flaw stems from a lack of capability checks, nonce verification, and validation of file extensions or MIME types when copying ZIP members to the uploads directory. Authenticated users with subscriber-level access or higher can exploit this to upload executable files, potentially leading to remote code execution. This issue is only present on sites with an active Freemius Premium license or trial, as the system relies on a site-level license check instead of per-user capability verification.

A use after free issue exists in the `mod auth digest` module. This occurs when an unauthenticated remote client sends concurrent Digest authentication requests while `AuthDigestNcCheck` is enabled or `AuthDigestNonceLifetime` is set to 0, leading to authentication state corruption. Use after free is a condition where a program continues to use a pointer after it has been freed, which can lead to crashes or unpredictable behavior.

The `ResourceIsolationRequestCycleListener` fails to properly protect applications against cross-site request forgery due to unsafe allowances in the `FetchMetadataResourceIsolationPolicy`. First, it allows all simple top-level navigations where `Sec-Fetch-Mode` is `navigate` and `Sec-Fetch-Dest` is neither `object` nor `embed`, regardless of the `Sec-Fetch-Site` value. This allows an attacker to trigger component listeners, such as `Link.onClick()`, through cross-site GET navigations. Second, it unconditionally allows requests with `Sec-Fetch-Site` set to `same-site`, enabling sibling origins (different subdomains or ports) to invoke listeners via any method, including POST form submits.