Hard to say, without knowing what you are running. I've seen people try to exploit this by email, hoping that users have ".forward" or ".procmail" files which

Hard to say, without knowing what you are running. I've seen people try to exploit this by email, hoping that users have ".forward" or ".procmail" files which are processed with bash, or which use it to execute commands, for example.