Nozomu Sasaki

The cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialize PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend, such as the file system or the `sys registry` database table, can inject a crafted serialized payload to trigger PHP Object Injection. This may allow the exploitation of a gadget chain to achieve Remote Code Execution.

Flawed logic in the Update Issue page 'bug update page.php' causes improper escaping of textarea custom field contents. This allows an authenticated user with low-privilege bug report permissions to inject HTML and potentially execute arbitrary JavaScript if Content-Security Policy (CSP) settings permit. Such execution can lead to session theft, administrative account takeover, and unauthorized access to full project data. Exploitation requires a textarea-type custom field to be configured for the project and affects any user viewing the bug edit form, including administrators.