Ka3N1X

Authenticated attackers can perform a server-side request forgery (SSRF) by providing a remote URL, such as a remote document or a syndicated site feed. The issue exists in the `recuperer url()` function within ecrire/inc/distant.php, which follows up to 10 redirects without re-validating the targets using the `valider url distante()` function. This allows requests to be redirected to internal or link-local addresses, including cloud metadata endpoints.

A crafted request to the external media inliner can lead to excessive CPU usage, resulting in the server becoming unresponsive. This issue requires Administrator access to be exploited.

A crafted content import file can lead to excessive CPU usage, resulting in the Ghost server becoming unresponsive. This issue requires Administrator access to be exploited.

An insecure direct object reference occurs in the 'POST' and 'DELETE' '/api/beszel/user-alerts' endpoints. This allows authenticated users to create or delete alerts for systems they are not authorized to access by providing arbitrary system IDs in the request body. This can lead to the disclosure of target system names and metrics through the resulting notifications.

An unauthenticated blind SQL injection exists in the SQL escaping layer. This issue allows attackers to inject arbitrary SQL by providing a crafted `annee` parameter value consisting of a word character followed by an open parenthesis, which bypasses escaping for date-type columns in MySQL, SQLite, and PostgreSQL backends. The flaw can be exploited via the `annee` criterion in the `sitemap.xml.html` template to execute time-based or boolean payloads. This can lead to the extraction of arbitrary database content, including the `alea ephemere` secret used to sign action nonces, and can be chained to achieve remote code execution (RCE).

An issue exists where authenticated users with media management permissions can delete arbitrary files. This occurs because the `deleteFile()` function in `MediaUploadTrait` only validates the basename of the filename, failing to sanitize directory traversal sequences such as `../`. Consequently, these unvalidated paths are passed to the `unlink()` function, allowing the deletion of files located outside the designated media storage directory.