WARNING: Source engine exploit

Keep in mind that this does not affect TF2 or CS:GO as they have both been patched long ago.
This exploit only exists in games running the Source SDK Base 2013 Multiplayer Tool such as Fistfull of frags and Team or in unpatched source engine games (Such as CS:S)

Keep in mind that you're able to work around this exploit by doing following commands (Put them into an autoexec so you don't have to do the commands every time you launch the game)

• Disable sprays in your settings
• cl_allow download 0
• cl_allowupload 0
• cl_customsounds 0

Source: https://www.reddit.com/r/Steam/comments/3jja73/source_2013_mp_base_file_upload_and_execution/

Yeah, I read about it in the HLDS mailing.

I've not replied for a long time there, probably more then 2 years or maybe even 3, but I know you did.

Valve pushed out an update for Counter-Strike: Source, Day of Defeaft: Source and Half-Life 2: Deathmatch to fix several security issues, so this should be fixed.

Additionally, a beta update for the Source SDK Base 2013 Multiplayer Tool has also been released fixing several security issues. (See the Reddit Thread on how to use the update)

Sources:
http://store.steampowered.com/news/18428/
https://www.reddit.com/r/Steam/comments/3jja73/source_2013_mp_base_file_upload_and_execution/