Privileged remote code execution via dynamic function call

Code injection in OrdaSoft Joomla Gallery editions before 6.2.7 allows remote authenticated users to execute PHP functions on the server. The updateOSGallery() handler reads method and package values from a JSON request body, then invokes the supplied method as a PHP function with package as its argument, without an allowlist or callable check. Access to the privileged update task is required; successful exploitation can run arbitrary operating-system commands in the Joomla server process context.