An improper neutralization of inputs used in expression
language allows remote code execution with the highest privileges on the
server.