vulnerability fix on uploader