Unauthenticated file upload via unchecked backup contents

Unrestricted file upload in MatiasDesuu ThinkDashboard 0.6.7 and earlier allows remote attackers to write files under /data. The Import handler accepts attacker-controlled multipart filenames and contents, joins each filename to the data path, and writes the bytes without server-side filename or content validation. No authentication or user interaction is required; uploaded HTML can execute stored scripts when opened, while other content can be distributed from the server.