Severity: Critical
CVSS Score: 10
LHA 1.14 and earlier allows attackers to execute arbitrary commands via a directory with shell metacharacters in its name.