Administrative privilege escalation via unsafe resource inclusion

Cross-site scripting in Apache Sling Engine before 2.14.0 allows remote authenticated users to gain administrative privileges. SlingRequestDispatcher lets an included resource's attacker-controlled content type and path override the enclosing response, causing stored content to be interpreted as executable markup. Exploitation requires content-writing access and a victim who renders the crafted inclusion; successful script execution gains the victim's administrative authority.