PT-2026-80208

Impact The backend FileUpload form widget trusted an attacker-controlled file id POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global system files table without verifying that the file belonged to the widget's...