Arbitrary file upload via Content-Type trust

Arbitrary file upload in the Image element in YOOtheme ZOO before 4.1.64 allows remote attackers to write files via frontend submission. The upload validation path decides whether a submitted file is an image from the client-supplied Content-Type alone and does not inspect the file bytes, so non-image content can be stored when labeled as image/. No authentication is required, but reachability depends on a published frontend submission form with an Image element; if uploaded scripts remain web-accessible and executable, the file write can become remote code execution.