Lukman Azri

A path traversal issue exists where users with media permissions can write arbitrary files by using `../` sequences in the `name` parameter. An attacker can utilize a base64 data: URI via the `crop url` media action to write an ERB (Embedded Ruby) template—a server-side templating system—into a theme's views directory, leading to code execution when the template is rendered.

An insecure direct object reference (IDOR) allows authenticated low-privileged attackers to escalate privileges by exploiting a parameter confusion flaw in the `UsersController` between the authorization filter and the action body. By sending a PATCH request to the 'updated ajax' endpoint, an attacker can set the `id` parameter to their own user ID to bypass self-authorization checks while setting the `user id` parameter to a victim's ID. This causes the controller to load and modify the victim's account, enabling the attacker to overwrite administrator passwords and achieve full site takeover.