It's possible to upload files to server without authentication.
vulners.com/securityvulns/securityvulns:doc:10698
vulners.com/securityvulns/securityvulns:doc:10796
vulners.com/securityvulns/securityvulns:doc:10797