ppxp does not drop root privileges before opening log files, which allows local users to execute arbitrary commands.
CVSS Metrics
