Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.
Published March 17, 2020.
Umbraco Umbraco CMS