An authenticated remote code execution issue exists where users with `custom fields` manage permissions can execute arbitrary Ruby code. This occurs when a malicious expression is supplied through the `select eval` custom field type. An attacker can store a controlled Ruby expression in the `command` parameter of the field options, which is then evaluated via the `instance eval()` function within an ERB view during the rendering of a post edit page. This allows for server-side code execution with the privileges of the web server process.