Commands injection is possible.
vulners.com/securityvulns/securityvulns:doc:32382
vulners.com/securityvulns/securityvulns:doc:32387