Acidcat CMS 3.4.1 does not restrict access to the FCKEditor component, which allows remote malicious users to upload arbitrary files.
acidcat acidcat cms 3.4.1