Alexander Künzl

Backend users with file write permissions can bypass upload restrictions in the Form Framework by using mixed-case extensions, such as `.FORM.YAML`. This allows the upload of maliciously crafted form definition files that can execute arbitrary SQL statements, enabling attackers to escalate privileges by creating administrative backend user accounts.

The issue allows administrator-level backend users without system maintainer privileges to escalate their privileges and gain system maintainer access. Exploiting this requires a valid administrator account.