Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.
Unrestricted Upload of File with Dangerous Type The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.