Design/Logic Flaw

Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack...