A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.
CVSS Metrics
