[formio] Server-Side Template Injection in formio

A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-28246
• https://github.com/formio/enterprise-release/blob/master/API-Server-Change-Log.md
• https://github.com/advisories/GHSA-52vj-mr2j-f8jh