Double free vulnerability in Web TransferCtrl Class 8 2 1 4 (iManFile.cab) as used in WorkSite Web 8.2 before SP1 P2 allows remote attackers to execute arbitrary code via JavaScript that sets the Server property to a string then sets the string to null.