An issue exists in the chunked file upload feature where the plugin fails to properly restrict the file types that unauthenticated users can upload. On servers configured to parse Server-Side Include (SSI) documents, such as Apache with SSI enabled, this allows an attacker to read server environment variables and the contents of files within the web root. Server-Side Includes are directives used to inject dynamic content into HTML pages before they are sent to the client.