CVE-2007-3572
Chain: incomplete denylist for OS command injection
CVE-2012-1988
Product allows remote users to execute arbitrary commands by creating a file whose pathname contains shell metacharacters.