Dangerous file upload via spoofed extension

Open Forms before 1.0.9 or 1.1.1 allows remote authenticated users to upload files with spoofed extensions via insufficient content-type validation. The submission attachment handler trusted the filename and client-declared MIME type instead of inspecting file bytes, allowing a file of one type to masquerade as another and bypass configured allowlists. Exploitation requires an authenticated account with upload access; resulting files can be downloaded or processed by staff and applications, propagating malicious content into trusted networks.