The Filesys::SmbClientParser module 2.7 and earlier for Perl allows remote SMB servers to execute arbitrary code via a folder name containing shell metacharacters.

More... (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3285)