Uploading a file did not check Joomla’s form token, neither in the back end nor in the front end. A prepared page on another web site could therefore make the browser of a logged in user upload a file into any event whose folder name it knows - and replace a file of the same name there, which removes the original. Only images and videos of the allowed types can be uploaded this way; it is no way to put code onto the server.