Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments.Referenceshttps://www.redmine.org/projects/redmine/wiki/Security_Advisorieshttps://www.redmine.org/news/131https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html
