It's a surprisingly common bug in custom web-based systems that handle documents or images - I've found this a number of times in systems I was reviewing (and I'm not a security expert).