Command injection

I, Librarian version =4.6 & 4.7 is vulnerable to OS Command Injection in batchimport.php resulting the web server being fully compromised...