A critical vulnerability was discovered in React Server Components (Next.js). Our systems remain protected but we advise to update packages to newest version. Learn More.
AI OnAI Off
A critical vulnerability was discovered in React Server Components (Next.js). Our systems remain protected but we advise to update packages to newest version. Learn More.
LinkItemCollection UI allows users to set "remaining URL" on internal pages. But the API removes it. The problem seems to be in EPiServer.ContentApi.Core.Serialization.Models.LinkItemNode.
Basically if it can get IContent out of the HREF it will get a new HREF using UrlResolverService.
IContent val = UrlResolverExtensions.Route(_urlResolver.get_Service(), (UrlBuilder)(object)new UrlBuilder(href));
if (val != null)
{
ContentLink = _contentModelService.get_Service().GetContentModelReference(val);
Href = _urlResolverService.get_Service().ResolveUrl(val.get_ContentLink(), null);
}