The issue involves two critical security vulnerabilities that can be exploited by authenticated users. The first vulnerability is a Remote Code Execution (RCE) issue via asset upload, where insufficient enforcement of allowed file extensions allows an attacker to upload executable files, such as PHP scripts. The second vulnerability is a Path Traversal issue in the upload validation process, which enables an authenticated user to manipulate the file deletion process and delete arbitrary files on the host system. It is estimated that over 200,000 organizations are exposed to this vulnerability.