Images do not work if their location is in the theme or module directory, resulting in broken images.

This would introduce a security vulnerability similar to https://www.drupal.org/sa-contrib-2024-006 → , so I can't accept the patch as it's provided.

When I wrote this check, I broke this functionality into a service so that sites that want to do something different can override it. So, if you want to allow images to be embedded from a theme folder, you can do that by decorating or replacing the EmbeddedImageValidator service in a custom module. I still would advise against removing the folder check entirely in your service, to avoid introducing a vulnerability to your site. Just allow the specific folders you want to allow.