Apache Flink version 1.9.x suffers from a remote code execution vulnerability via a malicious upload.