arbitrary file write vulnerability