The filter parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server.
https://127.0.0.1:3923/?ru&filter=(.+)+x
The server becomes fully inaccessible for a long time.
0.10.00.10.10.10.100.10.110.10.120.10.130.10.140.10.150.10.160.10.17+320 more1.18.9Exploitability
AV:NAC:LPR:NUI:NScope
S:UImpact
C:NI:NA:HCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H