Administrator command execution via unquoted upload path

OS command injection in SOY CMS before 3.14.2 allows remote authenticated users to execute arbitrary commands through file uploads. UploadFileAction appends the uploaded file path directly to a jpegoptim shell command without quoting, so a semicolon in the filename starts another command. Administrator access to the file-upload feature is required, and successful exploitation runs commands with the web-server process's privileges.