48.2.5.4. Do Not Remove the IncludesNoExec Directive
By default, the Server-Side Includes (SSI) module cannot execute commands. It is recommended that you do not change this setting unless absolutely necessary, as it could potentially enable an attacker to execute commands on the system.
