[Bug 1475068] CVE-2016-6127 rt: Cross-site scripting via malicious file upload