Diego García

An improper link resolution issue in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system with elevated privileges when generating a tech support file.

The issue allows remote authenticated users to inject arbitrary web script or HTML via specific fields, including the title field to certain template files, an event field, email field, or nickname field. This can be achieved by accessing specific endpoints, such as `objects.php` or `pages.php`, and manipulating the `title`, `event`, `email`, or `nickname` fields.

The issue allows remote authenticated users to execute arbitrary PHP code by uploading a file with a `.php` or `.php#` extension. This can be achieved by accessing the uploaded file via unspecified vectors.