Dangerous attachment storage via incomplete extension denylist

Unrestricted file upload in Trudesk before 1.2.4 allows attackers to store dangerous attachments via authenticated ticket requests. The ticketsController.uploadAttachment handler accepted every filename extension except .html, .htm, .js, and .svg instead of restricting uploads to known-safe types. A valid user session and a ticket attachment request reach the handler, and successful exploitation stores attacker-chosen content for later retrieval or processing.