GetSimpleCMS 3.2.1 Arbitrary File Upload

[shawn_a]

Well this is an authenticated upload, not some public thing. Who would you be protecting against ?
We do not even have real multi user support, so not users.

Of course you can rename a file extension, it is like a giant no shit sherlock.

If you have front side uploads then security needs to be handled much different.