system
Describe <CVE-2016-11020>.
user
What is <CVE-2016-11020>?
assistant
Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution..