Accellion FTA 9_12_432 and previous versions is affected by argument injection via a crafted POST request to an admin endpoint. The fixed version is FTA_9_12_444 and later.
accellion fta