Threats affecting pkg:github/unopim

UnoPim versions before 2.1.5 have an authenticated file upload vulnerability allowing administrators to upload arbitrary PHP files via the TinyMCE image upload endpoint. This occurs due to missing validation of file extensions and MIME types. Exploiting this, attackers can upload a PHP web shell to public storage and execute arbitrary OS commands on the server by accessing the uploaded file URL.