EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/toolbox/toolbox URI.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-26704.json"