Vendor
An incomplete URL sanitization routine in the Instatic isSafeUrl() function allows stored Cross-Site Scripting (XSS) via leading C0 control characters, enabling low-privileged users to achieve administrative account compromise.