Vendor
BlogEngine.NET versions 3.3.8.0 and earlier are vulnerable to arbitrary file upload via the /api/upload endpoint, allowing authenticated users with EditOwnPosts permissions to achieve remote code execution.