OX App Suite up to and including 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).
open-xchange ox app suite