Jake Yamaki

On Windows, Python uses the `VPATH` variable to locate landmarks, such as 'Modules/setup.local', to determine if it is running in a source tree and adjust the default `sys.path`. In certain configurations, specifically with the legacy EXE installer, the `VPATH` value '....' results in a landmark path outside the installation directory. Because Windows may allow low-privilege users to create folders in the root directory of the OS drive, an attacker could create the landmark and an alternative `Lib` folder. This allows the restricted installation to discover and load unauthorized files, potentially leading to a privilege escalation.

The issue is related to systemic CSRF, which affects the software's ability to prevent cross-site request forgery attacks.

A read-only user can access sensitive information via an API endpoint that reveals session cookies of authenticated administrators, leading to privilege escalation.

An issue allows an unauthenticated attacker to inject stored arbitrary JavaScript, which can be executed in the content viewed by authenticated administrators, resulting in a cross-site scripting (XSS) attack.