Remote Code Execution (RCE)

concrete5/concrete5 is vulnerable to remote code execution. An attacker is able to inject and execute malicious code via external file upload feature because, the library stages files in the public directory even when they have disallowed file extensions.