Je-Lv

File read handling fails to verify if the target of a resolved symbolic link remains within the source root and the user's authorized scope. This occurs because the `GetRealPath` function resolves symbolic links using `filepath.EvalSymlinks` but does not perform a containment check on the resulting path. Consequently, an authenticated user with download access or an unauthenticated user with a public share link can access server-accessible files outside their assigned scope, such as `/etc/passwd`, SSH keys, or container secrets, provided a reachable symbolic link exists. This issue affects several read flows, including download, preview, media, OnlyOffice, and public-share endpoints.

An issue exists when self-signup is enabled using the default `CreateUserDir` setting. Unauthenticated attackers can register accounts that inherit the server root scope, granting them full permissions to create, modify, delete, rename, share, and download all files on the server.

An arbitrary file read issue exists where the `create()` Twig function fails to include SplFileObject in its class instantiation blocklist. This allows an authenticated administrator with `allowAdminChanges=true` to configure a malicious entry type title or URI format that instantiates SplFileObject within a non-sandboxed template context. Consequently, when a user creates an entry in the affected section, sensitive server files, such as the `.env` file containing security keys and database credentials, can be read and rendered as entry titles.

A stored cross-site scripting issue exists in the control panel where draft names are rendered without HTML encoding in element chips and cards. This allows a low-privilege user with the ability to create element drafts to inject malicious JavaScript. The script executes in the browser of any higher-privileged user who views the affected element, potentially enabling unauthorized account creation and other authenticated actions.