AIKIDO-2026-965926

TL;DR

Bolt's async upload endpoint does not enforce a location-specific role check, so a user holding the ROLE_EDITOR role can upload files such as .twig templates into the active theme directory that is intended to be writable only by administrators. The same user can then reference the uploaded template through a templateselect field, causing Bolt to compile and render the influenced Twig when the record is viewed. Because the rendered Twig runs in the full application environment, missing authorization chains can lead to code execution as the web server user. The fix adds the missing authorization check to the upload controller so editors can no longer write into protected theme locations.