CVE-2026-54394

@@ -411,22 +411,20 @@ public function getOrgLogo($id) {
             throw new NotFoundException(__('Invalid organisation'));
         }
         $path = APP . 'files/img/orgs/';
-        $image = null;
+        $realBase = realpath($path);
         foreach (['id', 'name', 'uuid'] as $field) {
-            foreach (['png', 'svg'] as $extensions) {
-                if (file_exists($path . $org['Organisation'][$field] . '.' . $extensions)) {
-                    $this->response->file($path . $org['Organisation'][$field] . '.' . $extensions, ['download' => false, 'name' => $org['Organisation']['id'] . '.' . $extensions]);
+            foreach (['png', 'svg'] as $extension) {
+                $candidate = realpath($path . $org['Organisation'][$field] . '.' . $extension);
+                // realpath() resolves '..' and symlinks and returns false when the file does not
+                // exist; the prefix check rejects anything that escapes the orgs directory. Without
+                // it an attacker-controlled field such as the organisation name (e.g.
+                // '../../../../AI-marketing') would allow path traversal to arbitrary png/svg files.
+                if ($candidate !== false && $realBase !== false && str_starts_with($candidate, $realBase . DS)) {
+                    $this->response->file($candidate, ['download' => false, 'name' => $org['Organisation']['id'] . '.' . $extension]);
                     return $this->response;
                 }
             }
         }
-        if ($image) {
-            $filePath = $path . $image;
-            $this->response->file($filePath, array('download' => false, 'name' => $image));
-            return $this->response;
-        } else {
-            throw new NotFoundException(__('Organisation logo not found'));
-        }
-
+        throw new NotFoundException(__('Organisation logo not found'));
     }
 }

@@ -120,7 +120,11 @@
                 </select>
                 <input type="text" id="quickFilterField" class="form-control beta-search-input" placeholder="<?= __('Enter value to search') ?>" data-searchkey="<?= h($searchKey) ?>">
                 <button id="quickFilterButton" class="btn btn-primary beta-search-button"><?= __('Filter') ?></button>
-                <button class="btn btn-default beta-advanced-filter-button" onclick="getPopup('<?= h($urlparams) ?>', 'events', 'filterEventIndex')">
+                <?php /* json_encode emits a properly-escaped JS string literal; h() then guards the
+                       attribute layer. Plain h($urlparams) inside a single-quoted JS string is unsafe
+                       here: the browser HTML-decodes the onclick value before JS parsing, restoring any
+                       &#039; and allowing a crafted searcheventinfo value to break out (XSS). */ ?>
+                <button class="btn btn-default beta-advanced-filter-button" onclick="getPopup(<?= h(json_encode($urlparams)) ?>, 'events', 'filterEventIndex')">
                     <i class="fa fa-search"></i> <?= __('Advanced Filter...') ?>
                 </button>
                 <button id="multi-delete-button" class="btn btn-default hidden mass-delete" onclick="multiSelectDeleteEvents()" title="<?= __('Delete selected events') ?>">