CVE-2024-29891 — ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's — CVE Database · The Intelligence Room