Specially-crafted HTTP requests can lead to arbitrary command execution in “GET� requests. An attacker can make authenticated HTTP requests to trigger this vulnerability.