When using the file uploads feature, it was possible to upload PHP files.
The vulnerability is fixed in v3.1.2.