Screaming Penguin - Source Does Matter

A new QIII exploit has been found that allows malicious server operators to read-write ANY file on a client PC. This is important for client game players to be aware of (and probably not just for Quake) and for sysadmins to be aware of because it creates a type of "portal" into the clients machine and potentially into the network on which it resides.

Check the story via the link for more details and note that id has already released a patch.   Quake III Exploit Discovered by ISS: ZDNet