PT-2026-83648

Impact BackendWidgetsLists::evalImageTypeValue interpolated the resolved image URL into a single-quoted src attribute without escaping it. Where a list column of type image rendered an attacker-influenced value, that value could break out of the attribute and inject arbitrary attributes — includi...