Ronan Kervella

The issue allows remote authenticated users to upload and execute arbitrary JSP code via a .. (dot dot) in the `X-File-Name` header, exploiting a directory traversal vulnerability in the file import feature.