Remote code execution via deferred footnote evaluation

Privilege context switching in CryptPad XWiki Rendering allows remote authenticated users to execute server-side code through crafted footnotes. FootnoteMacro deferred parsing and execution until PutFootnotesMacro rendered the content, so nested macros ran under the later rendering context instead of the defining context. A simple XWiki account can bind a class sheet to its profile and place a Groovy macro inside a footnote, gaining programming rights and control of the installation.