Technically this is what you’d call a client-side vuln, but yes, server-side as in cloud.