Authenticated metadata access via unscoped attachment lookup

Improper access control in Winter CMS 1.2.12 and earlier allows remote attackers with backend access to alter unrelated attachment metadata. The backend FileUpload widget resolves an attacker-controlled file_id against the global system_files table without limiting the lookup to the active widget relation, parent record, or deferred-binding session. The built-in avatar form requires no specific permission, but exploitation requires a backend account, a valid session, and a CSRF token; successful requests can change attachment titles, descriptions, or ordering.