An authenticated superadministrator can execute arbitrary operating system commands as the web application user by uploading a crafted ZIP backup and triggering a restore. The issue occurs because SQL entries from the backup archive are streamed into the MySQL/MariaDB command-line client without the `--binary-mode` flag, causing the client to interpret lines starting with backslash commands, such as `!`, as local shell commands. This can lead to the exposure of application secrets, including database credentials and `APP KEY`, and allow the modification of application-writable files and data. The attack involves the following endpoints:
- 'POST /admin/backups/upload'
- 'POST /admin/backups/restore/{filename}'
The exploitation is possible when the optional `clean` sanitizer parameter is not used, which is the default behavior when `DB SANITIZE BY DEFAULT` is false.