An improper neutralization of inputs used in expression language allows remote code execution with the highest privileges on the server.