F3Nrir77

An authorization bypass allows authenticated clinicians who lack high-sensitivity permissions to read and modify encounter-bound forms. This is achieved by accessing the 'load form.php' endpoint to obtain restricted content and a CSRF token via the Clinical Notes or Care Plan direct loader, followed by submitting data to the 'save.php' endpoint to tamper with clinical records.

A path traversal flaw exists in the campaign import feature. During the extraction of uploaded ZIP files, a validation error allows file paths to exit the designated temporary directories. An authenticated user with `campaign:imports:create` privileges can write arbitrary PHP files to sensitive system directories, potentially overwriting internal configuration or cache components. This can lead to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a remote machine, under the context of the web server user.