version 3.14.1 is vulnerable to stored xss or ssrf via file upload.

[r4vanan]

Describe your problem

I found a cross-site scripting attack on the new content creating page http://localhost:800/admin/new-content
it will execute the script in user context allowing the attacker to access any cookies or sessions tokens retained
by the browser.
Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application.

Steps to reproduce the problem

• login into the account

• click on the new content like in that image
  

• click on the images button
  

• select the payload svg file which is injected with xss payload or ssrf payload
  

• insert and save the page
• copy the image link and open in the new tab
  

[dignajar]

You need to have access to the admin panel to change configurations and store XSS. Feel free to provide a solution via PR. Thank you for reporting the issue.