On line 1995 of CustomTemplateEngine.php, the template filename coming from $_POST['template']; is not being sanitized before usage. The input should be sanitized, similar to line 1830 in the same file:
$template_filename = htmlspecialchars($_POST['template'], ENT_QUOTES);
Thanks
On line
1995ofCustomTemplateEngine.php, the template filename coming from$_POST['template'];is not being sanitized before usage. The input should be sanitized, similar to line 1830 in the same file:Thanks