Yak! versions 2.1.2 and below suffer from remote directory traversal and arbitrary file upload vulnerabilities.