Jace

A server-side template injection occurs in the Twig theme rendering sandbox. The sandbox, designed to restrict user-uploaded theme templates, fails to fully enforce restrictions, allowing a crafted template to escape. An authenticated user with the `core:themes:create` permission can upload a malicious theme that, when rendered, enables arbitrary code execution with the privileges of the web server process. This allows for the execution of operating system commands, reading of server-side files such as configuration files and database credentials, writing files, and accessing internal services.

An authentication bypass by spoofing exists in the `dynamic oidc` strategy. This allows an attacker using one identity-provider connection to be signed in as a local user associated with a different connection. The issue occurs because the intended identity namespacing, which should format the `strategy` field of `UserIdentity` rows as `"<name>/<connection id>"`, is not applied. Instead, the ` connection id ` variable is only populated on an ephemeral runtime struct and is not used during the identity change process in the `DynamicOidc.IdentityChange.change/3` function. Consequently, the system falls back to the bare strategy name for identity writes and reads in `oauth2/user resolver.ex` and `oauth2/sign in preparation.ex`. Because the unique key for the identity resource is `(uid, strategy)` and the system does not handle the `iss` (issuer) claim, users from different providers with the same `sub` (subject) value are treated as the same user. This can lead to account takeover without victim interaction or the silent merging of distinct users who happen to share the same subject identifier across different providers.

A flaw exists in the file-ico plugin when processing specially crafted ICO image files. The plugin fails to properly validate the `used clrs` (palette count) parameter, leading to improper memory bounds checking and a heap out-of-bounds read. This can result in an application crash, causing a denial of service or limited information disclosure of heap memory contents.

A flaw exists in the file-pvr plugin where the VQ (compressed) decoder fails to properly perform memory bounds checking when processing specially crafted PVR image files. This missing validation leads to a heap out-of-bounds read, which can cause the application to crash, resulting in a denial of service or limited disclosure of heap memory contents.

A flaw in the Seattle FilmWorks plugin occurs when processing a specially crafted SFW image file. The plugin allocates a Variable-Length Array (VLA)—an array whose size is determined at runtime—on the stack without performing integer overflow checks. This results in an unbounded stack allocation, leading to an application crash and a denial of service.

A flaw in the file-xwd plugin occurs when processing specially crafted XWD image files. The plugin validates image width and bytes-per-line parameters independently instead of ensuring their combined values align with the allocated buffer size. This improper bounds checking in the `load xwd f2 d1 b1()` and `load xwd f1 d24 b1()` functions leads to a heap out-of-bounds read, which is a condition where the program reads data past the end of the intended memory buffer. This can result in an application crash causing a denial of service or a limited information disclosure of heap memory contents into the resulting image.