The PdfBook extension up to and including 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.
pdfbook project pdfbook