See: https://packetstormsecurity.com/files/142897/IPFire-2.19-Remote-Code-Execution.html
Fixed in: http://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=a9a91e5fa713c14f59d20228c228f0e67c4365a8
This seems to be closed. :-)