Authenticated code execution via unvalidated update content

Code injection in Automai Director 25.2.0 allows remote authenticated users to execute arbitrary system commands through its update mechanism. The updater improperly validates or restricts update sources and content, then executes attacker-supplied commands during the update process. A valid account with update access is required, and successful exploitation grants command execution in the Director server context.