Apache Pluto uses web.xml security constraints to control access to resources. These security constraints have been insecurely defined allowing authentication to be bypassed. An attacker can call the PortletV3AnnotatedDemo Multipart Portlet and upload an arbitrary file. The uploaded file is directly accessible within the /PortletV3AnnotatedDemo/temp/ directory. This technique allows an unauthenticated attacker to install a malicious JSP file and remotely execute code on a server running Apache Pluto. Apache Pluto's multipart file uploader is vulnerable to directory traversal. An attacker is able to upload a file outside the default /temp directory to an arbitrary location on the filesystem.