An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.
Update the affected components to their respective fixed versions.
The action can be invoked by any user able to reach Frontend.