Design/Logic Flaw

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...