Flowoverfail

A server-side template injection occurs in the Twig theme rendering sandbox. The sandbox, designed to restrict user-uploaded theme templates, fails to fully enforce restrictions, allowing a crafted template to escape. An authenticated user with the `core:themes:create` permission can upload a malicious theme that, when rendered, enables arbitrary code execution with the privileges of the web server process. This allows for the execution of operating system commands, reading of server-side files such as configuration files and database credentials, writing files, and accessing internal services.

A path traversal issue exists where clients with permissions to create instances can write files to the host system. This occurs due to unvalidated dependent custom volume names within the instance backup `index.yaml` files. An attacker can import a specially crafted instance backup containing `../` sequences in the dependent volume names to create root-owned directories with controlled content, which can lead to full host compromise.