An Expression Language Injection exists in EmailServices. A remote authenticated attacker with `OFBTOOLS VIEW` and `ACCOUNTING VIEW` permissions can execute arbitrary operating system commands as the account running the software. This occurs when a `${groovy:...}` expression is submitted as the `bodyText` or `subject` value to the Send Per Email invoice form. The `sendMailFromScreen` function passes these values through `FlexibleStringExpander.expandString`, which evaluates embedded Groovy without the `SecureASTCustomizer` restrictions typically applied by `GroovyUtil.eval`.