Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-35132.json"