If you allow the IMG tag in acs-kernel, you're opening things up to a security risk, but that may be alleviated somewhat by a new package called sudo, that Barry's developing.
Check your acs-kernel parameters and if you're not allowing * or IMG, you're fine, I think.
