Je-Lv

**Name of the Vulnerable Software and Affected Versions** filebrowser versions prior to 2.63.17 **Description** An issue exists when self-signup is enabled using the default `CreateUserDir` setting. Unauthenticated attackers can register accounts that inherit the server root scope, granting them full permissions to create, modify, delete, rename, share, and download all files on the server. **Recommendations** Update to a version newer than 2.63.16. Disable the self-signup feature or modify the `CreateUserDir` setting to restrict user scope.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 5.0.0-RC1 through 5.10.5 Craft CMS versions 4.0.0-RC1 through 4.18.1 **Description** An arbitrary file read issue exists where the `create()` Twig function fails to include SplFileObject in its class instantiation blocklist. This allows an authenticated administrator with `allowAdminChanges=true` to configure a malicious entry type title or URI format that instantiates SplFileObject within a non-sandboxed template context. Consequently, when a user creates an entry in the affected section, sensitive server files, such as the `.env` file containing security keys and database credentials, can be read and rendered as entry titles. **Recommendations** Update Craft CMS versions 5.0.0-RC1 through 5.10.5 to version 5.10.6. Update Craft CMS versions 4.0.0-RC1 through 4.18.1 to version 4.18.2.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions prior to 5.10.8 **Description** A stored cross-site scripting issue exists in the control panel where draft names are rendered without HTML encoding in element chips and cards. This allows a low-privilege user with the ability to create element drafts to inject malicious JavaScript. The script executes in the browser of any higher-privileged user who views the affected element, potentially enabling unauthorized account creation and other authenticated actions. **Recommendations** Update Craft CMS to version 5.10.8 or later.