Arbitrary Code Execution

whereis is vulnerable to arbitrary code execution attacks. The application does not properly escape the filename, which is then concatenated to the exec() function, allowing a malicious user to inject and execute arbitrary code.