A critical issue has been found in the Favicon Handler component of DouPHP, affecting some unknown functionality of the file /admin/system.php. The manipulation of the `site favicon` argument leads to unrestricted upload. This issue can be exploited remotely. The exploit has been disclosed to the public and may be used.