An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.