A user with administrator privileges and access to the advanced admin logging configuration could trigger remote code execution via PHP Object Injection.
Part of SUPEE-11155
This vulnerability affects the following application versions:
- Magento 1.9.4.1