It's possible to download, upload and execute any file.
vulners.com/securityvulns/securityvulns:doc:4225
vulners.com/securityvulns/securityvulns:doc:4226