@cR0w looks like there's another hushed-up zero-day out therein CraftCMS: https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3