Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files with \uploads/upload_file.\ destination filenames via unspecified vectors to upload.cgi accessed from upload.html.