An OS Command Injection issue exists in the NAS backup provider plugin. The 'addBackupRepository' and 'updateBackupRepository' API endpoints accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when a backup restore is performed by any account.