Authenticated file storage via extension-only validation

Unrestricted file upload in Certificate Generation System allows remote authenticated users to store dangerous files on the server. The restructured/csv.php handler checks only the final filename extension, retains the attacker-controlled name, and moves the file into a web-accessible directory without inspecting its type or content. Authenticated access is required; code execution additionally depends on the server treating an accepted upload as executable.