"This behavior can be exploited by an attacker who has the ability to write files to the server, allowing the execution of arbitrary code" if they've got that far with malicious intent you're fucked anyway, surely?
@pikesley somewhat depends on the rest of the attack. When I attach an image to a post here I’m writing files to the server, and that’s everything working as intended.