The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.