Proclaim from Christian Web Ministries (installs as com_biblestudy), versions 9.1.1 and previous, arbitrary file upload, also backup file download
resolution: update to 9.1.2 fixes both issues
update notice: https://github.com/Joomla-Bible-Study/Joomla-Bible-Study/releases
.