An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM. 
CWE-434 Unrestricted Upload of File with Dangerous Type