"FacturaScripts\Core\UploadedFile::move($destiny, $destinyName)" concatenates "$destiny" and "$destinyName" without normalizing the resulting path. Every caller in the codebase passes "UploadedFile::getClientOriginalName()" — the unsanitized client-supplied filename — as "$destinyName", so an authenticated user submitting a filename containing "../" segments can write the uploaded content to any directory writable by the web-server user, escaping the intended "MyFiles/" location. Because the shipped "htaccess-sample" (the documented production Apache configuration) excludes "Dinamic/Assets/" and "node_modules/" from the "index.php" rewrite, files written into those directories are served directly by Apache. Combined with ".htaccess" not being in "BLOCKED_EXTENSIONS", the primitive escalates from arbitrary file write to remote code execution.