A command injection vulnerability in maintenance.cgi in Mutiny \Monitoring Appliance\ before 6.1.0-5263 allows authenticated users with access to the admin interface to inject arbitrary commands within the filename of a system upgrade upload.