Remote code execution via attachment path traversal

Remote code execution in ManageEngine Exchange Reporter Plus 5721 and earlier allows attackers to run arbitrary commands through Content Search. The module uses a malicious attachment filename when downloading the attachment, allowing it to escape the intended directory and enable command execution. Exploitation requires user interaction in a rare Content Search workflow and executes commands on the target server.