CasaOS before v0.2.7 was discovered to contain a command injection vulnerability via the component leave or join zerotier api.