Sunu11

The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the `admin/theme configs/form` data, specifically through the `ThemeConfig][logo` parameter in the `libBaserModelThemeConfig.php` file.

The issue allows remote code execution via an upload file request for a .zip file. This .zip file is automatically extracted and may contain .php files, leading to potential code execution.