Authenticated arbitrary file write via upload filename

Path traversal in lenve VBlog 1.0 allows remote authenticated users to write uploaded image data outside its dated image directory. The uploadImg handler appends the unvalidated original multipart filename to a server-side directory and passes the resulting path to FileOutputStream. A valid application session and a crafted filename containing traversal segments are required; successful exploitation writes or overwrites files writable by the service account.