Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
Published October 4, 2021.
Cobbler Project Cobbler