Cpe:2.3:a:blogengine:blogengine.net:*:*:*:*:*:*:*:*

BlogEngine.NET versions 3.3.8.0 and earlier are vulnerable to arbitrary file upload via the /api/upload endpoint, allowing authenticated users with EditOwnPosts permissions to achieve remote code execution.