Arbitrary File Write (via Path Traversal) in nopCommerce

A path traversal vulnerability leads to arbitrary file write

nopCommerce version 4.50.3 and below

A remote attacker can craft a malicious request to upload his/her own avatar to the system, which may result in arbitrary file write, including overwriting existing files used by nopCommerce.
The vulnerable endpoint relies on user-input to determine both the mime-type of the uploaded file, and the content of the file. The mime-type is set according to the Content-Type header, which is controlled by the attacker, and isn’t go through any sanitization or validation.
Similarly, the content of the file is just the content of the multipart request, without any validation.