CVE-2018-9209: FineUploader php-traditional-server unauthenticated arbitrary file upload vulnerability

The vulnerability stems from two key issues in endpoint.php: 1) No authentication requirement for uploads, and 2) The $uploader->allowedExtensions array being empty by default (line 38), disabling file type filtering. While the allowedExtensions configuration is set in endpoint.php, the actual vulnerability manifests in the UploadHandler::handle() method which executes the upload logic using these insecure defaults. The advisory explicitly references lines 37-38 in endpoint.php where these insecure configurations are set, and the handle() method is the entry point that processes uploads without performing critical security checks.