An image upload ran a vulnerable ExifTool, so a crafted file triggered CVE-2021-22204 for code execution.