≤ 3.6.0
An attacker can upload an arbitrary file instead of a plant image.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.