ImpressCMS (www.impresscms.org) has released an updated version of their content management system to provide a more secure environment for the sites built on their platform. The default settings allowed anonymous access to the image upload folders. This could happen even if you do not enable the WYSIWYG (what you see is what you get) editors for any group.

It is strongly recommended you take action to reduce the risk of your sites being compromised.