FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.
CVSS 2.0HIGH 7.5·Network·No auth·Interaction —·EPSS 0.03732·Published 2014-04-21·Fixed in 20140418CWE-77