medium6.0
CVE-2026-77139
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files.
Impact
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.