Josua Vogel

Forms utilizing FileUpload or ImageUpload elements with a custom `saveToFileMount` configuration store uploaded files in the default storage folder `1:/user upload/` instead of the intended destination. This behavior can result in files being placed in publicly accessible storage despite the configuration of a restricted, non-public storage. Files stored in this manner are served directly, bypassing the access checks typically applied to non-public storages.

Users can upload files with arbitrary MIME types to forms utilizing FileUpload or ImageUpload elements that have `allowedMimeTypes` configured. This occurs because the `MimeTypeValidator` is registered during form building before concrete form definition properties are applied, which prevents the validator from being added to the processing pipeline and allows the server-side restriction to be bypassed.