Unauthenticated code execution via upload cleanup race

Authentication bypass in Versa Networks Versa Concerto 12.1.2 through 12.2.0 allows remote attackers to execute code via crafted requests. AuthenticationFilter decodes and normalizes the request URI before checking it, while controllers use the undecoded path; this exposes the Spack upload endpoint, which builds file paths from uploaded filenames and briefly writes attacker-selected files before cleanup. No credentials are required, but code execution depends on winning the cleanup race so ld.so.preload and a malicious shared object coexist when the container health-check curl command runs.