UploadServlet in Bajie HTTP JServer 0.78 and possibly other versions before 0.80 allows remote attackers to execute arbitrary commands by calling the servlet to upload a program then using a ... (modified ..) to access the file that was created for the program.