AIKIDO-2026-661685

TL;DR

Filament Curator lets authenticated media-library users upload files and crop curations through a Filament panel. The curation modal's saveCuration() writes to a client-supplied key path without validation, so a crafted key can resolve onto and overwrite a sibling file inside the storage disk. Separately, SVG sanitization is gated on the client filename extension while the serving layer types the file from sniffed bytes, so SVG markup uploaded under another extension is stored unsanitized and can be served as image/svg+xml inline and execute script in the application origin. The fix validates the curation payload before writing, sanitizes SVGs based on the detected type, and pins the served Content-Type from the stored extension with a forced download and nosniff for unknown types.