Steps to reproduce the issue

Install joomla-cms/staging@1c52ed3

Create media field, only completing the required fields such as:

Go to front end and edit article - click select on the media field

Expected result

Nice model with a good look and feel and I should only be able to link to MEDIA (like an IMAGE!)

Actual result

I can scroll down and type into the Image URL text box anything I like, specifically I could add

../../../csrf.php

which would then render

<img src="/../../../csrf.php">

when the article is viewed.

Furthermore, I can enter an off server PHP file path like:

http://www.example.com/attack.php

which renders as

<img src="http://www.example.com/attack.php">

This could be used by anyone with frontend access to introduce security issues

System information (as much as possible)

https://gist.github.com/PhilETaylor/b1ff259a06518f903339950ca81e35d7