Launchpad.net

CVE 2017-1000215

ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution

See the CVE page on Mitre.org for more details.