Arbitrary file upload via unchecked filename suffix

Unrestricted file upload in UCMS 1.6 allows remote attackers to upload arbitrary files through the ucms/sadmin/file PHP endpoint. The endpoint accepts an uploaded file without validating its filename suffix, permitting dangerous file types to pass the upload handler. No authentication or user interaction is required; the resulting impact depends on where and how the server stores and handles the uploaded file.