Arbitrary file upload and XML External Entity processing

PKSA-b6j6-98g6-jt8b

Affected package: neos/flow

Affected version: >=2.3.0,<2.3.7|>=3.0.0,<3.0.1

Reported by:
FriendsOfPHP/security-advisories