IMCE PHP: path option should have a permission

Many sites are fully locked down when it comes to accessing PHP directly while allowing users to access standard site configuration. However, this filter bypasses all PHP processing restrictions and can be used to gain higher access to the system very easily.

I considered this a security vulnerability, but as per the security team respsoned:

After careful review, because this vulnerability requires the compromised account to have the 'administer site configuration'
permission, it can be fixed publicly as per http://drupal.org/node/475848.

The security team suggested removing the option, my recommendation would be to add a new permisson that limits its' use to those users that have the permission.

Cheers

Alan