Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.