Thomson Reuters FATCA suffers from an arbitrary file upload vulnerability that can result in command execution.