PT-2026-61815

Summary An authenticated user with the HR "Manage Employees" permission SA EMPLOYEE can upload a file with an arbitrary extension through the employee Documents tab. The handler writes the raw client-supplied filename — extension intact — into a web served directory with no extension, MIME, or...