Arbitrary BugFree File Upload

The new BugFree version has the File Upload Vulnerability.
Every day, the Bug change is annoying. You can check out BugFree. The file upload vulnerability exists in the new version and official demonstration sites.
Select any Bug editor> attachments to upload any file. Because the download of the BugFree file is not directly linked to the actual address of the file, instead, you can use a program to read and download the source address, so finding the real name of the file is also a physical activity. However, if you have a column directory or other vulnerabilities, it is very easy to use shell. It is quite difficult for the time being. After the bug is fixed, read the program.


 Solution:

Type restrictions. The old version has verification. Where does the new version verify?