In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.

参照URL

• advisory github.com
• advisory nvd.nist.gov
• web docs.expressionengine.com
• web gist.github.com
• web hackerone.com