In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.
CWE-434