Unauthenticated command execution via shell-interpreted image path

Command injection in Etherpad Lite ep_imageconvert 0.0.2 and earlier allows remote attackers to execute shell commands via crafted URLs. The imageConvert request handler inserts the untrusted URL path into three child_process.exec command strings, allowing shell metacharacters to alter the invoked command. No authentication or user interaction is required; successful exploitation runs commands with the Etherpad process's privileges and can crash the server when a command produces no standard output.