OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).
- https://seclists.org/fulldisclosure/2022/Jul/11
No PoCs found on GitHub currently.