The issue allows sed data injection in diag routes.php. Authenticated users can inject sed-specific code and write an arbitrary file in an arbitrary location. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although common protection mechanisms against command injection are used, such as the escapeshellarg function for the arguments, the sed-specific code injection is still possible.