An unrestricted file upload vulnerability was discovered in a Java Spring Boot application. By sending a PUT request to /api/v1/customer/profile-picture with a malicious file payload, an attacker could upload files like .jsp, .php, or .html. By then accessing the uploaded file through the URL returned in the response, remote code execution could be achieved.