Unspecified vulnerability in Kiwi before 3.74.2 as used in SUSE Studio 1.1 before 1.1.4 allows remote attackers to execute arbitrary code via a crafted archive name in the list of testdrive modified files.