Unauthorized ecartis mailing lists manager access

Attachment sent to -request address is saved to web accessible folder, allowing to put files on the Web server...