Upload files with Filemanager without loggin

In many installations with exponentcms I detected that if we append at the end of the URL modules/filemanagermodule/actions/picker.php?id=0, we can upload files without loggin. For example, in this page we can upload files with this bug