A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.