CVE-2025-22213

No fix known EPSS <1%CVSS 7.1

Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.