Phpwind9.0 arbitrary code execution of a plug-in on the cloud platform

Phpwind9.0 was released after a long delay. It looks like NB, but who knows it? All kinds of bugs are everywhere, all kinds of errors... this is an example. The killer type ..., the official website does not fix the problem. I am using a new version .. at the time of sign-in, write a few quotation marks to customize what I want to say, and then get the cup .. after submission, the absolute path is reported directly ..
'000000' => array ('uid' => '000000', 'author' => 'xxx', 'times '=> '000000 ', 'hits '=> '32', 'money' => '32', 'day' => '1', 'shits' => '0 ', & apos; bhits & apos; = & apos; 32 & apos;, & apos; content & apos; = & apos; content & apos;, & apos, then the syntax is wrong. I am a good boy. As for this, I can still upload the magic horse, no longer YY .. black and wide people understand ..Solution:..