UploadFile.php in MoniWiki 1.0.9.2 and earlier when used with Apache mod_mime does not properly handle files with two file extensions such as .php.hwp which allows remote attackers to upload and execute arbitrary code.