Shell characters are not filtered in filename than external 'ditto' command in executed with system().
vulners.com/securityvulns/securityvulns:doc:8736