Insecure $ENV{PATH}