Edito CMS has a vulnerability in its avatar upload functionality that allows attackers to upload files of any type and extension, bypassing the intended file type restrictions in the UI. This flaw was addressed in version 5.10.2607, with hotfixes also available for older 5.8 versions.