Authenticated arbitrary file upload via unfiltered suffix

Unrestricted file upload in SpringBootMovie 1.2 and earlier allows remote authenticated users to publish files with arbitrary suffixes. The upload handler accepts a client-controlled filename suffix and publishes the file without filtering its extension; the public report demonstrates this with a .php file but does not identify the function in text. High-privilege authentication is required, and the demonstrated consequence is storage and publication of attacker-chosen file types rather than confirmed server-side execution.