An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_save.
CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)