The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.
A flaw was corrected in rubygem-mail version 2.4.4:
A file system traversal in filedelivery method [1].
[1] https://github.com/mikel/mail/commit/29aca25218e4c82991400eb9b0c933626aefc98f