Please report suspected vulnerabilities through GitHub private vulnerability reporting. Include the version, deployment type, required permissions and a reproduction with test data. Do not post real credentials or private files in an issue.

Application administration does not imply permission to execute server programs. File uploads, remote connections, public shares and delegated administration are security boundaries, including when several permitted features can be combined to cross them.

See security boundaries and verification for the review, testing and release process. Use the newest security patch release and read its upgrade notes; security fixes can deliberately restrict unsafe historical configurations.