Prasanthsundararajan69

The extension installer fails to validate ZIP entry names during extraction. This allows attackers to use traversal sequences, such as `../` in filenames, to write arbitrary files outside the intended directory, which can lead to code execution.

A path traversal issue exists in the theme import functionality. This allows attackers to write files outside the intended theme directory by using malicious theme ZIP files containing traversal sequences in filenames. This can lead to the modification of sensitive files, such as `.bashrc` or `.ssh/authorized keys`, or the execution of arbitrary code.

Step CA is an online certificate authority designed for secure, automated certificate management. A flaw exists where the software does not adequately protect against unauthenticated certificate issuance through the SCEP UpdateReq (MessageType=18). This allows attackers to potentially obtain valid certificates for any domain without providing credentials. The `SCEP UpdateReq` bypasses all authentication checks within Step CA.