A user with permissions to edit a mailbox signature can bypass the `Helper::stripDangerousTags()` function by combining nested tag fragments with a scriptable file uploaded via the '/uploads/upload' endpoint. Because the resulting external script is served from the same origin, it bypasses the `script-src 'self'` Content Security Policy (CSP) when another user accesses the new-ticket page or the mailbox reply editor. This allows the script to execute with the privileges of the victim, enabling the reading of visible data and the performance of same-origin actions.