Oops looks like a new vulnerability in 3.0.18