Custom action dispatcher bypasses access_control on other routes

PKSA-7ck7-y4vp-mmcz

Affected version: >=4.0.0,<4.29.16|>=5.0.0,<5.5.1

Reported by:
FriendsOfPHP/security-advisories

[HIGH] Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

PKSA-8yhb-cz5n-f41h CVE-2026-54087 GHSA-8559-gwj3-q37r

Affected version: >=5.0.0,<5.0.13

Reported by:
FriendsOfPHP/security-advisories, GitHub