Fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted editor access but had editor.cmsassets or editor.tailorblueprints specifically withheld, an uncommon permission configuration. In this edge case, such users could perform file operations (create, delete, rename, move, upload) on theme assets or blueprint files despite lacking the required sub-permission. A related operator precedence error in the Tailor navigation also disclosed the theme blueprint directory tree under the same conditions.

Impact - Only exploitable by authenticated backend users with editor access who have been specifically denied the editor.cmsassets or editor.tailorblueprints sub-permissions - Does not affect default permission configurations where editor users typically have all sub-permissions granted - Users without editor.cmsassets could manipulate theme asset files (delete, rename, move, upload, create directories) - Users without editor.tailorblueprints could manipulate blueprint files (delete, rename, move, upload, create directories) - Users without editor.tailorblueprints could view the theme blueprint navigation tree, disclosing file paths and directory structure

Patches The vulnerability has been patched in v3.7.16 and v4.1.16. Fine-grained document type permission checks are now enforced on all asset and blueprint file operation commands, and the navigation node condition logic has been corrected. All users are encouraged to upgrade to the latest patched version.

Workarounds - Restrict the editor permission to fully trusted administrators only - Remove the editor permission from any user who should not have asset or blueprint management access

A reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping.

Impact - Reflected XSS only, no stored/persistent component - The backend URL prefix is customizable and must be known or guessed by the attacker - Requires an authenticated backend user to visit a crafted URL - No direct access is gained without social engineering

Patches The vulnerability has been patched in v3.7.16 and v4.1.16. The affected parameter is now properly escaped. All users are encouraged to upgrade to the latest patched version.

Workarounds - Use a non-default backend URL prefix (recommended as standard practice) - Implement a Content Security Policy (CSP) for backend pages

A vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safemode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on any database table through the query builder, which is included in the sandbox allow-list.

Impact - Arbitrary database writes including modification or deletion of any table - Requires authenticated backend access with Developer permissions - Only relevant when cms.safemode is enabled (otherwise direct PHP injection is already possible)

Patches The vulnerability has been patched in v3.7.14 and v4.1.10. Write operations such as insert, update, delete, and truncate are now blocked on query builder and model objects within the Twig sandbox. All users are encouraged to upgrade to the latest patched version.

Workarounds If upgrading immediately is not possible: - Restrict Developer tool access to fully trusted administrators only

Reporter - Reported by Chris Alupului

A server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safemode enabled.

Impact - Potential exposure of sensitive server-side files - Requires authenticated backend access with Editor permissions - Only relevant when cms.safemode is enabled (otherwise direct PHP injection is already possible)

Patches The vulnerability has been patched in v3.7.14 and v4.1.10. When cms.safemode is enabled, .less, .sass, and .scss files can no longer be created, uploaded, or edited across the CMS editor, media manager, and file upload interfaces. All users are encouraged to upgrade to the latest patched version.

Workarounds If upgrading immediately is not possible: - Set cms.editableassettypes config to ['css', 'js'] to remove preprocessor file types from the editor - Restrict Editor tool access to fully trusted administrators only

- Reported by Chris Alupului

A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.

Impact - Stored XSS via malicious SVG files uploaded through the Media Manager - Could allow privilege escalation if a superuser views or embeds the malicious SVG - Requires authenticated backend access with media upload permissions (media.library.create) - SVG must be viewed or embedded in a page to trigger

Patches The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.

Workarounds If upgrading immediately is not possible: - Disable SVG uploads by adding svg to the blocked extensions in media configuration - Set media.cleanvectors to true in configuration (enabled by default)

References - Reported by Offensive Security Research Team