The issue arises from insufficient sanitization or escaping of variable values used in shell command execution. This results in shell code injection via functions such as create(), run file(), backup(), or restore(). The problem allows unauthorized users to execute code with the same privileges as the running application.