WebInterface in OctoBot prior to 0.4.4 allows remote code execution because Tentacles upload is mishandled.
octobot octobot