Vinchin Backup & Recovery version 7.2 contains an authenticated remote code execution (RCE) vulnerability through the deleteUpdateAPK function. This flaw allows an attacker with valid credentials to execute arbitrary code remotely. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability. No specific affected versions beyond v7.2 are stated, and no patch or remediation details are provided in the available data.