I've tested this on both Ubuntu 14.04 and CentOS 6.5, and they both sanitize the path variable such that this is not possible. I believe this is controlled via

I've tested this on both Ubuntu 14.04 and CentOS 6.5, and they both sanitize the path variable such that this is not possible. I believe this is controlled via the secure_path setting in your /etc/sudoers file.