(CWE-184) that allows cross-site scripting (CWE-79) attacks. Other chains are also
present.
There is a subtle composite that involves insecure permissions (CWE-732), a missing
protection mechanism, and symlink following. Assuming a UNIX-based permission