Description Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code. References http://blog.etherpad.org/2018/04/07/important-release-1-6-4/