Jiwoong Lee

**Name of the Vulnerable Software and Affected Versions** MaxUpload – Big File Uploads – Increase Maximum File Upload Size versions prior to 1.4.1 **Description** An arbitrary file upload issue exists in the `handle upload()` function. A filename-validation mismatch occurs because extension and MIME checks are applied to the uploaded chunk's filename but not to the final assembled filename derived from the `resumableFilename` parameter. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution. **Recommendations** Update MaxUpload – Big File Uploads – Increase Maximum File Upload Size to a version newer than 1.4.0. As a temporary workaround, restrict access to the `handle upload()` function to minimize the risk of exploitation.