@evelyn @FloatingGhost Also it's trivial to mitigate at 100% with having the files being non-writable to the user running the server (in fact you probably could run it in an immutable container with database+uploads separated).

I'd guess the explaination is they were running From Source style and are reacting 1+ month later given that https://transwo.men/objects/309ea454-310b-4961-9f8f-4f93ef6a440c indicates it's already been fixed.