No evidence of an RCE from what I can tell, just whats set in BTCPay

I don't run BTCP, this is what I've gleaned from the patch commits, you should reach out to the BTP devs to ameliorate any other concerns.