An remote attacker with low privileges can perform a command injection which can lead to root access.