Security context

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

modules/system/twig/SecurityPolicy.php: most-fixed (7 issues). Treat as high-risk during review.

44 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass / Authorization Bypass: Multiple fixes show permission checks were missing or mismatched on AJAX handlers, controller actions, and settings items, allowing unauthorized access to user management, theme editing, import/export, and settings. The pattern of adding requiredPermissions or per-item checks indicates systemic gaps in access control enforcement.

Sandbox Escape / Code Execution: Seven fixes to the Twig security policy show a persistent cat-and-mouse game: dangerous methods (insert/update/delete, bindEvent, addDynamicMethod) and functions (source, constant) were repeatedly added to blocklists. The transitive forwarder chain and SafeCollection proxies indicate attackers found multiple ways to reach restricted methods.

Path Traversal / Arbitrary File Upload: Path traversal and unsafe uploads recur across media library, asset management, and upload widgets. Fixes added path validation, extension allowlists, and filename checks, but the variety of sinks (move, File::put, resolve_path) suggests each file-handling path needs independent validation.