Local code execution via locale-directory command injection

Command injection in OpenText iManager 3.0.0 through 3.2.6.0300 allows local users to execute code through crafted configuration files. The checkForLocaleDirectory function reads EDir_Instance_File_Path, opens a second attacker-selected file, appends its contents to a command line without sanitization, and executes it. Exploitation of this flaw alone requires low-privileged local access and two attacker-controlled files; remote pre-authentication use requires chaining separate flaws.