OX App Suite up to and including 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.
open-xchange ox app suite