Posted by Ron E on Sep 03Description: Payara Server contains a vulnerability in its Server-Side Includes (SSI) implementation that allows arbitrary operating system command execution via the #exec directive. The issue occurs because user-controlled SSI directives are passed directly to Runtime.exec() without validation, sanitization, or restriction. An attacker who can cause the server to process an SSI file (e.g., .shtml) can execute arbitrary OS commands with the...