Concrete CMS versions below 9.5.3 have a vulnerability in the conversation attachment upload endpoint where files are imported into the file manager before the system checks if the user has the "Add Message Attachments" permission. This permission check occurs only after the file is stored, allowing users without permission or unauthenticated visitors in guest-posting configurations to import approved file types into the file manager.