Binganaoo

**Name of the Vulnerable Software and Affected Versions** Roncoo Education version 9.0.0 **Description** The issue is related to an arbitrary file upload vulnerability in the `/course/api/upload/pic` component, allowing attackers to execute arbitrary code via a crafted file. **Recommendations** For Roncoo Education version 9.0.0, consider disabling the `/course/api/upload/pic` component until a patch is available to prevent arbitrary file uploads and subsequent code execution. Restrict access to this component to minimize the risk of exploitation. Avoid using this component for file uploads until the issue is resolved.