MediaWiki PandocUpload Extension Remote Code Execution Vulnerability

How could an attacker exploit this vulnerability?
An authenticated attacker could exploit this vulnerability by uploading a file with the destination name as a malicious payload due to shell arguments not being properly escaped. When successfully exploited this could allow the malicious actor to perform remote code execution.

According to the CVSS metric, the attack vector is network (AV:N), and privilege required is low (PR:L). What is the target used in the context of the remote code execution?
The attacker for this vulnerability could target the server accounts in an arbitrary or remote code execution. As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server's account through a network call.
The privilege requirement is low because the attacker needs to be authenticated as a normal user.

Security updates
1.0.1 — https://github.com/microsoft/MediaWiki-Extensions