Arbitrary File Upload

cos is vulnerable to arbitrary file upload. The vulnerability exists as it does not delete the uploaded files under certain exceptions...