As recently posted on the Inside3D forums, apparently the Quake engine lets you overwrite the game data with savegames should you be enough of a moron to call your save “pak0.pak”, a bug that seems to hail all the way from the original release eighteen years ago.
What’s even more amazing is that this hasn’t been fixed yet. I wonder what else is in there.
This just reinforces my belief that it’s best to hide the game’s console from the player. Unfortunately with an open source game, completely hiding it is impossible.