go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarchive parameter.
https://github.com/mikaku/Monitorix/issues/30
https://euvd.enisa.europa.eu/vulnerability/EUVD-2004-2766